# LAI #150: Can a Sandbox Stop a Hostile Agent? > Source: > Published: 2026-11-05 15:01:04+00:00 Good morning, AI enthusiasts! An agent that can run for hours, remember past work, call tools, use credentials, and accept new instructions is useful for the same reasons it is hard to control. You have to decide what it can access, what it should remember, who is allowed to redirect it, which actions need approval, and what happens when something fails halfway through. Those choices increasingly define the system’s behavior as much as the model itself. We have several good examples of that this week. You’ll learn: Plus, a community project that lets you mix regular code, model calls, autonomous agent steps, and human approvals in the same TypeScript workflow. Let’s get into it! This week in What’s AI, I spoke with Tony Holdstock-Brown, co-founder and CEO of Inngest, about what actually breaks when an agent runs for hours or days. Their data suggests the model is often not the main problem: server timeouts or dropped connections appeared in 41% of affected accounts, compared with 15% for LLM API errors. The main idea is to stop treating a long-running agent as one loop that stays alive in memory. Instead, split the work into steps and save each result outside the process. If one step fails, you retry that step rather than restarting the whole run. The same applies to waits for approvals, webhooks, or customer replies: pause the run, hold no compute, and resume when the event arrives. We also get into what an agent should remember versus re-read, why side effects such as refunds and emails need idempotency, how deploys can break runs that started under older code, and why token budgets and iteration caps need to live inside the agent. The full article covers when a simple queue is enough, when durable execution starts to make sense, and how to test whether an agent can actually recover from failure. [Read it here](https://louisbouchard.substack.com/p/stop-building-agent-loops-start-building)! Promising an LLM a $200 tip or telling it “my job depends on this” was a popular prompting trick in 2023. Today, researchers at Wharton tested these exact lines across modern models and proved that they do nothing. Sometimes they even lower your accuracy. While running benchmarks for our [AI Engineering for Production](https://www.louisbouchard.ai/book/?utm_source=TAI&utm_medium=email&utm_id=AItips) book, we first started by removing contradictory instructions. A prompt might say “explain every detail” near the top and “keep it brief” later. The model then has to decide which instruction matters more. In one of our test notebooks, removing two conflicting instructions reduced a 382-word response to 171 words on the first run, without asking the model to “try harder.” Now, before shipping a prompt, we focus on three things: *— Louis-François Bouchard, Towards AI Co-founder & Head of Community* [Carlosmartineztuanama_87198](https://discord.com/channels/702624558536065165/983037843532308500/1563389450292174890) built Chloe, an open-source TypeScript runtime for building AI agents that run on your own machine. Instead of treating every task as fully agentic, it lets you choose how much autonomy each step needs: You define each agent in TypeScript, including its model, tools, memory, jobs, and channels, and can run jobs manually, on a schedule, or from chat. The runtime stays local, while an optional cloud connection gives you remote access to the dashboard. [Check it out here](https://chloejs.org/) and support a fellow community member. If you have questions or feedback, [share them in the thread](https://discord.com/channels/702624558536065165/983037843532308500/1563389450292174890)! The Learn AI Together Discord community is flooding with collaboration opportunities. If you are excited to dive into applied AI, want a study partner, or even want to find a partner for your passion project, [join the collaboration channel](https://discord.gg/rj6m9AF7eC)! Keep an eye on this section, too; we share cool opportunities every week! 1. [_joshan_](https://discord.com/channels/702624558536065165/1567266437842739220/1567266437842739220) is building a rough prototype for an AI startup and is looking for a technical co-founder. If you have an AI/ML background and want to get into the startup space, [connect with them in the thread](https://discord.com/channels/702624558536065165/1567266437842739220/1567266437842739220)! 2. [_joshua171](https://discord.com/channels/702624558536065165/1565052880644210778/1565052880644210778) is looking for collaborators to start building something together, share ideas, and even explore a potential long-term partnership. If you want more details, [reach out to them in the thread](https://discord.com/channels/702624558536065165/1565052880644210778/1565052880644210778)! 3. [Debashish_parida5](https://discord.com/channels/702624558536065165/1563061618668085330/1563061618668085330) is building an open-source Python framework designed to provide modular, extensible building blocks for RAG systems, autonomous agent execution, and multimodal pipelines. They are looking for help with multimodal integration, high-performance storage & retrieval, agent state management, and testing & refinement. If this is your area of expertise, [contact them in the thread](https://discord.com/channels/702624558536065165/1563061618668085330/1563061618668085330)! Meme shared by [bin4ry_d3struct0r](https://discord.com/channels/702624558536065165/830572933197201459/1565764757787644025) [I Ran One Fake Hostile Agent Through Five Sandboxes on My Mac](https://pub.towardsai.net/i-ran-one-fake-hostile-agent-through-five-sandboxes-on-my-mac-f3060128d1ff?sk=f137ef42622cff59f16a42afa5244450) by [Hubert Nakielski](https://medium.com/@hubert.nakielski_3676?source=post_page---byline--f3060128d1ff-----------------------------------------) Sandboxing can limit what a coding agent can access, but the protection also depends on what you mount, which credentials you provide, and where the agent can connect. This article runs the same simulated hostile agent through macOS Seatbelt, a hardened container, Docker Sandboxes, gVisor, and Firecracker, with canary secrets planted to test each setup. All five blocked access to a protected key and prevented deletion of the project, but credentials deliberately passed to the agent remained readable and could be sent to any permitted host. 1. [Episodic, Semantic, and Procedural Memory in AI Agents](https://pub.towardsai.net/day-34-100-episodic-semantic-and-procedural-memory-in-ai-agents-502a156f9795?sk=3469536ca79b519101ccd2951aef3d8c) by [Montasir Mahmud](https://medium.com/@mmcse19?source=post_page---byline--502a156f9795-----------------------------------------) Agent memory becomes harder to manage when facts, past experiences, and behavioral instructions are all stored in the same store. This article separates memory into three types in LangGraph: semantic memory for facts, episodic memory for past events that can be reused as examples, and procedural memory for instructions the agent can update through reflection. It gives each type its own namespace, write conditions, and place in the prompt, and explains how updates should differ. 2. [LLM Inference: What Actually Happens Inside an LLM](https://pub.towardsai.net/llm-inference-what-actually-happens-inside-an-llm-632a59149509?sharedUserId=tai-tech) by [Ahmad Bilal](https://medium.com/@ahmadbilalch891?source=post_page---byline--632a59149509-----------------------------------------) The first token of an LLM response usually takes longer to produce than the tokens that follow because prefill and decoding perform different work. This article follows one prompt through a decoder-only transformer, covering tokenization, embeddings, Query-Key-Value attention, prefill, decoding, and the KV cache. It then connects those mechanics to GPU memory bandwidth and metrics such as time to first token, before explaining how continuous batching, PagedAttention, and speculative decoding improve inference performance. 3. [The Steering Wheel Problem: run.steer(), turn/steer and Who May Redirect a Running Agent](https://pub.towardsai.net/the-steering-wheel-problem-run-steer-turn-steer-and-who-may-redirect-a-running-agent-75d3af8be022?sharedUserId=tai-tech) by [Ali Süleyman TOPUZ](https://topuzas.medium.com/?source=post_page---byline--75d3af8be022-----------------------------------------) Several coding tools let a user redirect an agent while it is already running, but that creates a permissions problem when steering instructions can come from other sources. This article compares how Cursor, Codex, Grok Build, and Alook handle steering and examines why MCP annotations such as readOnlyHint do not provide enforcement on their own. It then builds a .NET prototype that restricts steering with turn-ID checks, allowlists, and approvals tied to SHA-256 hashes of the requested action. Prompt injection through shared communication channels remains unresolved, so the design still relies on human approval for sensitive changes. 4. [Guardrails in Microsoft Foundry: How Content Safety Scoring Works](https://pub.towardsai.net/guardrails-in-microsoft-foundry-how-content-safety-scoring-works-a7c935308003?sk=a6ace5a79f831ab56963a44076a95e68) by [Katakamvivek](https://medium.com/@katakamvivek?source=post_page---byline--a7c935308003-----------------------------------------) Microsoft Foundry can score model inputs and outputs for hate, sexual content, violence, and self-harm, but teams still have to decide which severity levels their application should allow. This article explains how Content Safety scoring works and shows how to configure guardrails at both the model and agent levels. It also covers Prompt Shields for jailbreaks and indirect prompt injection, and builds a Python pipeline that checks both input and output and fails closed when the safety service cannot return a result. The article finishes with latency and cost considerations, PyRIT red teaming, and a checklist for testing guardrails before deployment. If you are interested in publishing with Towards AI, [check our guidelines and sign up](https://contribute.towardsai.net/). We will publish your work to our network if it meets our editorial policies and standards. [LAI #150: Can a Sandbox Stop a Hostile Agent?](https://pub.towardsai.net/lai-150-can-a-sandbox-stop-a-hostile-agent-a0d855f9f8cf) was originally published in [Towards AI](https://pub.towardsai.net) on Medium, where people are continuing the conversation by highlighting and responding to this story.