{"slug": "pi-am-i-sandboxed", "title": "pi: am I sandboxed?", "summary": "Pi, a coding agent from earendil-works, incorrectly claimed it was not sandboxed, but probing commands revealed it runs inside a Debian 12 container on an Alpine Lima VM under Rancher Desktop, with a macOS-shaped working directory and a /.dockerenv file. The agent's self-description came from its system prompt, not its actual environment, highlighting that agent introspection is documentation lookup, not measurement.", "body_md": "♠ **Problem statement**: asking a coding agent whether it runs in a sandbox\nreturns a confident answer derived from its system prompt, not from the machine\nit is actually running on.\n\nI asked [Pi](https://github.com/earendil-works/pi-mono) exactly that. The reply\nwas assured:\n\nNo — pi itself doesn’t sandbox tool execution. When I run\n\n`bash`\n\n,`edit`\n\n, or`write`\n\n, they execute directly on your machine with your user’s permissions, in the current working directory (`/Users/thiago.perrotta/.pi`\n\n). […] But there’s no OS-level sandbox (no container, no seccomp, no filesystem jail).\n\nIt’s plausible, well-formatted, and…**wrong**!. One typo-ridden command was\nenough to break the illusion:\n\n```\n% ls ~/worksppace\nls: cannot access '/home/hostuser/worksppace': No such file or directory\n```\n\n`~`\n\nis not `/Users/thiago.perrotta`\n\n. The follow-up probe:\n\n```\n% pwd; uname -a; whoami; cat /etc/os-release\n/Users/thiago.perrotta/.pi\nLinux lima-rancher-desktop 6.18.37-0-virt #1-Alpine SMP PREEMPT_DYNAMIC 2026-06-29 10:52:25 aarch64 GNU/Linux\nhostuser\nPRETTY_NAME=\"Debian GNU/Linux 12 (bookworm)\"\n```\n\nA macOS-shaped `pwd`\n\ninside an aarch64 Debian container, on an Alpine\n[Lima](https://lima-vm.io/) VM, under Rancher Desktop. *Containerception*.\n\nAnd the giveaway at the filesystem root:\n\n```\n% ls -la / | head -5\ntotal 68\ndrwxr-xr-x   1 root root 4096 Aug 15 00:54 .\ndrwxr-xr-x   1 root root 4096 Aug 15 00:54 ..\n-rwxr-xr-x   1 root root    0 Aug 15 00:54 .dockerenv\ndrwxr-xr-x   3 root root 4096 Aug 15 00:54 Users\n```\n\n`/.dockerenv`\n\n, plus a `/Users`\n\nbind mount recreating just enough of the host\npath for the system prompt’s `cwd`\n\nto resolve.\n\nThe model was not lying; it had no way to know. Its self-description comes from\ntokens someone else wrote, while the ground truth sits one `uname`\n\naway. The\nuseful lesson is that agent introspection is a documentation lookup, not a\nmeasurement — for anything security-relevant, make it run the command.\n\nThe sandbox was [cco](https://perrotta.dev/2026/02/cco-claude-condom-sandbox/).\n\n🤖 *Drafted with *\n\n`/bloggify`\n\n.— § —\n\nReply via [email](mailto:serendipity@perrotta.dev?subject=Reply to: pi: am I sandboxed?)", "url": "https://wpnews.pro/news/pi-am-i-sandboxed", "canonical_source": "https://perrotta.dev/2026/08/pi-am-i-sandboxed/", "published_at": "2026-08-14 22:56:29+00:00", "updated_at": "2026-08-14 23:12:18.472215+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools"], "entities": ["Pi", "earendil-works", "Lima", "Rancher Desktop", "Debian GNU/Linux 12", "Alpine", "cco"], "alternates": {"html": "https://wpnews.pro/news/pi-am-i-sandboxed", "markdown": "https://wpnews.pro/news/pi-am-i-sandboxed.md", "text": "https://wpnews.pro/news/pi-am-i-sandboxed.txt", "jsonld": "https://wpnews.pro/news/pi-am-i-sandboxed.jsonld"}}