YOLO Mode Without the Yikes: Sandboxing Autonomous Coding Agents

GitHub · Security · DevSecOps

Thursday 29th - 14:00 - 16:00

A coding agent is the most useful when it can run without stopping to ask permission at every step. The catch is that it borrows your permissions – your SSH keys, your cloud credentials, your whole home directory – and it spends all day reading instructions it can't vet: a fetched web page, a cloned repo's AGENTS.md, a tool response. One hostile instruction in the wrong place and a helpful agent becomes a way to leak credentials, delete the wrong directory, or pull in a poisoned dependency. Approval prompts don't help much here, because the thing writing the prompt is the same thing being manipulated.

This workshop takes the other route. Instead of trusting the agent to police itself, we build a boundary around it so mistakes and attacks stay contained. We start by mapping how things actually go wrong (untrusted input → dangerous capability → real damage), then work through the protections that cut each link: filesystem and network isolation, kernel-enforced boundaries that hold even after the model is confused, and keeping credentials out of the sandbox as much as possible. Then we build a working sandbox from scratch with a lightweight, cross-platform, open-source approach you can wrap around any agent, and we verify it with scripts that prove each control holds rather than taking it on trust. You'll leave with a setup you can drop into your own projects, and a way of understanding agent safety that isn't tied to any one tool.

Key Takeaways

Containment beats self-control: shape the blast radius instead of approving every action. The same idea applies to CI runners, plugin systems, and anything else you run but can't fully trust.
A way to reason about agent safety: read any risk as vector → capability → impact, and match each protection to the link it cuts, so you can evaluate any solution.
A working, cross-platform sandbox and the verification scripts to match – both yours to take home and use the same day.

Target Audience

Developers and teams already running coding agents, or about to.
Security-minded engineers who want a practical approach to agent safety.
Tech leads looking for a sharper mental model around AI agent risks and containment.
No security or sandboxing background required; if you're comfortable with a terminal and Git, you'll be fine.

Requirements

A laptop with a coding agent already installed (Claude Code, Codex, Opencode, or similar).
Git installed and a terminal environment you're comfortable using.
Windows users must have WSL2 installed (WSL1 is not sufficient).
No prior sandboxing or security hardening experience required.
An interest in running coding agents safely without giving them unrestricted access to your systems and credentials.

Schedule

Workshop Plan

Threat Model and Safety Foundations (20–30 min)

How coding agents interact with untrusted inputs.
Understanding the chain from attack vector to real-world impact.
The protections that break each link in the chain.

Building a Cross-Platform Sandbox (75–85 min)

Creating a lightweight containment environment from scratch.
Applying filesystem, network, and credential isolation.
Wrapping existing coding agents with practical safeguards.
Working through real examples and setup steps.

Verification and Testing (15–20 min)

Using verification scripts to prove protections are working.
Testing containment boundaries and validating assumptions.
Common pitfalls and troubleshooting tips.

Wrap-up and Q&A (5–10 min)

Applying the containment mindset to AI agents, CI systems, and plugin ecosystems.
Next steps and resources for further experimentation.