Using AI agents effectively without trusting them

Running AI agents autonomously on open-source code inside isolated sandboxes lets teams get value from agents without granting them access to sensitive data or production infrastructure, according to a government practitioner's account citing UK guidance on AI, open code and vulnerability risk in the public sector. The author argues open source provides the "firebreak" needed for autonomy, since code already publicly available on the internet can safely enter a clean sandbox, and lists bug fixes, performance profiling and optimisation, experimental feature building, and understanding complex systems as high-value uses. The piece ties the approach to sandboxed agent services such as Codex Cloud/ChatGPT Work and Claude Cowork, noting that for closed-source codebases deciding what is sensitive is time-consuming, while open-source teams have already done that work continuously.

Using AI agents effectively without trusting them using-ai-agents-effectively-without-trusting-them As they become more capable, the most valuable use cases of AI agents increasingly require them to work autonomously for hours without constant manual approvals. But AI agents cannot be trusted https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ with sensitive data or access to production infrastructure. We can use sandboxes for isolation, but that only helps if we know what we can safely put in the sandbox. Luckily in government we already have a well-established https://www.gov.uk/guidance/ai-open-code-and-vulnerability-risk-in-the-public-sector , practical solution that fits the problem very well: open source. This provides the firebreak that’s needed: if all that goes into a clean, isolated sandbox is code that’s already openly available on the internet, we can safely allow the agent to work autonomously. In my experience, this is surprisingly valuable. We can get a long way with things like: - Bug fixes - Performance profiling and optimisation - Building experimental new features - Understanding complex systems and how they interact AI companies clearly recognise that many of the most valuable use cases of agents involve them operating autonomously within isolated environments. That’s a big reason for the recent trend towards providing these environments as part of services like Codex Cloud/ChatGPT Work and Claude Cowork. With these sandboxes, the user must decide exactly what information and permissions to give to the agent. But for closed-source codebases, this can be a very time-consuming problem to solve. What parts of the code are sensitive, and how can we find out without reviewing every line? That’s what makes open source especially valuable: development teams have been doing this job continuously throughout the development process. Of course, there are cases where the agent really does need access to sensitive information, and we should simultaneously be trying to solve that problem. But open source has an enduring advantage of simplicity: when new models are released, we can safely put them to work on public codebases.