mkagenius

It's also unclear what kind of sandboxing they are referring to. Is it the codex one - coz that one has built-in ways to circumvent guardrails, for example by "just asking user" and sometimes just resolves to no sandbox needed on its own.

In case someone wants to deep dive into how codex and claude code approaches sandboxing -https://instavm.io/blog/how-claude-code-and-codex-approach-s...

You might want recheck your theory - https://news.ycombinator.com/item?id=48970377

What I meant to say there is, all the bloats are going away as we speak, is the bun rewrite a bloat? A slop? why would you call it one if it's not. What if we used AI in a way that produced genuinely better work than humans.

I am not saying that you hide it. I am asking is it still fair to treat it as a "slop"? slop being a derogatory term here

The others work on repository or codebase. Mine works on API traffic realtime captured via mitmproxy.

More like a red team.

Answered in the thread above- https://news.ycombinator.com/item?id=48955273

Mostly from internal tests. And also some of the companies we know uses firecracker has published benchmarks[1]

1. https://x.com/mlejva/status/2069424250709307451?s=20

If there is a pentester here who uses mitmproxy, the security skills below (distilled from 4000 h1 disclosures) might help -https://github.com/instavm/security-skills

this is just a side project though for me

Mostly people are lazy and assume that the big labs can't be releasing unsecure software or it's their responsibility.

dangerously skip permissions and yolo is kinda becoming the default as it gets more done.

I used to ask my coding agent to present two alternatives to choose from while implementing a task, and include a tokens required for each alternative to implement. (So that I can choose one which needs less token vs one which needs more rigour depending on task)

Finally there is evidence that the model kinda actually knows the correct token spend on each method.

you mean amodei

Our nixos sandboxes are mostly a cloud offering at this time. Scale is what we can offer additionally. Have secret injection built in too. I see you have suspend, resume we have the same. We have snapshots and cloning. Startup time is sub second with warm pools - which will go further down when we replace firecracker with Tarit soon.

1. Tarit - https://GitHub.com/instavm/tarit

If you are into nixos, we at InstaVM have just launched[1] nixos based sandboxes.

1. https://instavm.io/blog/nixos-reproducible-dev-environments-...

Made the exact same thing when apple containers were released - https://github.com/instavm/coderunner#run-claude-code-inside...

Free idea: I would like to be able to "jail" an agent inside a VM and send instructions to the harness from outside the VM to agent(s) installed inside. Ideally there is no Codex/Claude/etc. installed on the host.

You can do exactly that with coderunner

https://GitHub.com/instavm/coderunner

One would. But then the results are even weirder as opus 4.6 scored more than opus 4.8 by a huge margin

It looks like the author is specifically avoiding model's name, because results are really weird.

  Opus 4.8/4.7 scored 28%

  Opus 4.6 score 37%

Token smuggler sounds like a profession coming soon. For distillation and stuff.

Have you tried https://instavm.io in US

Useful in splitting a big task - some parts are easy so give it to say Gemini. Some are harder so give it to gpt 5.5 and so on.

Also the throughput kind of increases since providers are different.

We have created Murmur[1] which kind of works with your existing subscription (having API key is not mandatory). You can just tag @copilot @codex from claude code to delegate work to them. (it can also do it on its own too btw)

1. https://github.com/instavm/murmur - Murmur

Not so subtle plug for another sandbox provider, https://instavm.io :

Apart from the above features.

  1. We support more than 32GB disk (as a shareable device, ideal for agentic memory)

  2. We provide egress control

  3. We provide vault for secret injection (to counter prompt injection)

  4. Snapshot / forking.

  5. long lived sandboxes.

Can be used via - npx skills add instavm/skills

AWS for AI agents - https://instavm.io

Providing sandboxes through a CLI. Guardrails such as egress control and secret injection and audit trails built in.

We can also be used as 3rd party sandboxes in Anthropic managed agent and OpenAI sdk.

https://instavm.io/blog/self-hosting-claude-managed-agents-o...

6 months a bummer, but we got it for apple sandbox - coderunner (https://github.com/instavm/coderunner)

We got it yesterday, maybe they just started rolling it out and hence op posted this.

Yes it is funnily true but it was for fake news generation and not it's cyber capabilities.

Another fun little gem of information, government has something called Mayhem

the autonomous Robo-Hacker AI called Mayhem that’s now in charge of protecting the Pentagon’s most critical systems

Guess Mythos and Mayhem had a chat

Apple containers are great for providing a sandbox to your AI coding agents

I have made it a MCP so that it's easily discoverable by all the coding agents

https://github.com/instavm/coderunner

The article misses the point that you can have a third option - harness inside and outside both.

The use cases will evolve so much more in coming weeks and months that the boundaries will blur. You can still contain the agent outside in a sandbox though.

With instavm (https://instavm.io), you can provide an OCI image built from a dockerfile.

I also felt the need for a cloud based cron like automations, so decided to build it myself https://cronbox.sh with:

  1. an ephemeral linux sandbox for each task 
  2. capability to fetch any url
  3. can use tools like ffmpeg to fulfill your scheduled task

Not just sides, the vents are much sharper.

Few years back, I tried to look on reddit for complaints regarding this - barely anything.