Anthropic detailed the containment architectures it uses for Claude across web, developer, and desktop products, arguing that agent safety depends on deterministic limits on filesystem, network, and e…
Appaloft, an open-source delivery platform, built a four-link evidence chain — freeze, preview, promote, verify — to prove what exact artifact was approved and is actually running in production, addre…
Agent Shell, a hardened Linux box accessible via SSH or browser, gives AI agents like Claude, Codex, and Gemini real root access with gVisor sandboxing to prevent host compromise. The platform, operat…
Google Cloud has released a blueprint for securing AI workloads on Google Kubernetes Engine (GKE), consolidating controls across multiple services to address infrastructure, model supply chain, and ap…
Google launched Cloud Run sandboxes into public preview at WeAreDevelopers World Congress, enabling Cloud Run services to execute untrusted AI-generated code inside isolated gVisor-based environments …
A developer shared a hardened Docker sandbox configuration for MCP servers, combining --network none, gVisor's runsc runtime, and strict resource limits. The setup has been used to audit 8,764 MCP ser…
Docker launched Sandboxes in April 2026, using microVMs to isolate AI coding agents, shifting the container-versus-VM debate to a three-way comparison with microVMs. MicroVMs provide hardware-enforced…
A 2026 comparison of AI agent sandbox technologies evaluates isolation models from container-based Docker to microVM platforms like Firecracker and CubeVM, highlighting trade-offs in security, perform…
MarketNow built a 6-layer audit pipeline called Sentinel that tests for 7 of the 10 OWASP MCP Top 10 risks. The pipeline uses active probes, sandboxing, dependency scanning, and weekly re-audits to de…
A developer built MarketNow, a marketplace that security-audits every MCP server before listing, after 30 CVEs were filed against MCP servers in 60 days. The audit pipeline, Sentinel, includes static …
A developer building MarketNow, a marketplace for MCP servers, shares findings from auditing 8,764 MCP servers using gVisor for sandboxing. They found that about 50% of MCP servers fail to start under…
Apoxy released CLRK, an open-source agent runtime that uses gVisor for isolation and runs on Kubernetes, designed to provide fully intercepted I/O, framework-agnostic guardrails, and audit trails for …
CNCF Ambassador Lin Sun of Solo.io wrote on July 7, 2026 that sandboxing alone is insufficient for running large-scale AI agent fleets, contrasting the Kubernetes SIG Apps project agent-sandbox with t…
A developer built Sentinel, a six-layer audit pipeline that runs every MCP server in the MarketNow catalog. The pipeline combines static analysis, dependency scanning, behavioral pattern detection, ad…
A developer ran Anthropic's official filesystem MCP server inside a gVisor sandbox as part of a multi-layer security audit for the MarketNow marketplace. The gVisor userspace kernel intercepted all sy…
Tako Research released TakoVM, an open-source sandboxing tool for AI agent code execution that provides Docker isolation, job queues, execution history, and retry logic out of the box. The tool aims t…
Agent Substrate, a new platform for running AI agents, reduces idle agent costs by 90% compared to traditional Kubernetes Pod deployments. By using an actor model with checkpoint/restore and gVisor, i…
A new approach to cybersecurity evaluations proposes using language models as constant red-team oracles to empirically compare the attack surfaces of different software implementations, such as OpenSS…
Autonomous AI agents are moving from experimental playgrounds into enterprise application architecture, requiring robust design patterns and security measures. A developer with 20+ years of experience…
A Hacker News user discovered that ChatGPT's container environment provides 56 CPU cores and 4GB of RAM, prompting an investigation into the infrastructure. The containers run on gVisor, a sandboxed k…