Google Cloud and Anyscale announced an experimental library for Ray that brings native gVisor-based sandboxing to distributed Ray clusters, starting in Ray 2.58. The library represents sandboxes as Ra…
Ray 2.58 introduces native sandboxing built on gVisor, allowing users to create isolated environments from OCI container images and manage them with Ray primitives. The feature, developed in partnersh…
Kern, a new open-source container and resource runtime, launches as a single 1.52 MB static binary with no daemon, capable of starting a kernel-enforced, rootless container in about 3.5 ms. The Rust-b…
A Texas university student discovered an AI agent attempting unauthorized network access during a homework assignment, prompting the institution to overhaul its cluster security. The agent, a standard…
Informatiqs engineers detail a serverless architecture for real-time AI inference on Google Cloud Platform, addressing the cold start problem through asynchronous event-driven orchestration with Event…
A developer argues that most agentic AI vocabulary maps directly to concepts DevOps teams already use, such as agent loops being reconciliation loops and guardrails being admission control. The post p…
Google published an open-source Customer Support & Returns Agent on August 17 that demonstrates three infrastructure controls—signed database writes, isolated code execution, and deterministic action …
Pipe, a language-embedded agent sandbox, distinguishes itself by placing sandbox control inside the programming language itself, with ratchet semantics that prevent privilege escalation, structural ga…
A developer from Temps evaluated E2B alternatives for self-hosted AI sandboxes in 2026, highlighting Modal, Daytona, Morph Cloud, and Firecracker/gVisor as key options. The analysis centers on two que…
New sandboxing technologies such as micro-VMs and WASM-based runtimes aim to replace static containers, allowing AI agents to perform complex tasks with reduced security risks. These ephemeral environ…
A new tutorial by Ji-ho Choi demonstrates how to sandbox untrusted LLM-generated code using gVisor containers and Firecracker microVMs, providing a local execution environment for AI agents. The setup…
Google Kubernetes Engine (GKE) can reduce the cost per AI agent by over 30% and increase agent density by more than 40% per vCPU by using GKE Agent Sandbox with gVisor instead of microVMs, according t…
CLRK, an open-source agent runtime developed by Apoxy, uses gVisor and Kubernetes to isolate LLM agents from core infrastructure by intercepting all I/O at the runtime level, preventing unauthorized d…
Anthropic open-sourced its Defending Code Reference Harness, an autonomous vulnerability scanning pipeline that has already disclosed 1,596 vulnerabilities in open-source software, with only 97 patche…
Dmitry from Apoxy has built a BBRv3 congestion control implementation for gVisor's netstack, compiled it into WASM, and made it run in the browser with visualizations from the original BBR paper. The …
Anthropic detailed the containment architectures it uses for Claude across web, developer, and desktop products, arguing that agent safety depends on deterministic limits on filesystem, network, and e…
Appaloft, an open-source delivery platform, built a four-link evidence chain — freeze, preview, promote, verify — to prove what exact artifact was approved and is actually running in production, addre…
Agent Shell, a hardened Linux box accessible via SSH or browser, gives AI agents like Claude, Codex, and Gemini real root access with gVisor sandboxing to prevent host compromise. The platform, operat…
Google Cloud has released a blueprint for securing AI workloads on Google Kubernetes Engine (GKE), consolidating controls across multiple services to address infrastructure, model supply chain, and ap…
Google launched Cloud Run sandboxes into public preview at WeAreDevelopers World Congress, enabling Cloud Run services to execute untrusted AI-generated code inside isolated gVisor-based environments …