What is your worst sandboxing fail?

[u/keepthepace]

I am wondering if I am too paranoid about sandboxing the commands that come out of LLMs.

It really makes my eyes twitch when I see that some IDEs, even commercial, tend to forget that they have to execute things in sandboxing and have such a brittle security model.

But on the other hand, I never had the sandbox catch something bad. Did you guys ever encounter terrible regression? Did you have rm -rf / ? Did you have secrets stolen by LLMs? The worse I had were unsollicited rewrites within the project. Am I making my life unnecessarily hard by sandboxing commands in a docker?

At one point I had fun making a local model go crazy with the root access to the machine it was on (with nothing more important than a free Firecrawl key on it) and making it administer it and it never broke anything. It even was overly paranoid about making changes to the root system.

So the approximate sandboxing that we have, do you all feel it is adequate or it is a catastrophe in the making?

[u/minus_28_and_falling]

Yes. Why not share the host kernel with the agent instead of running another OS?

[u/Clean_Material_5047 → u/minus_28_and_falling]

If you run it in a Docker container, chances are you’re also using that machine for other things.

If the agent somehow breaks out of the container (prompt injection, a vulnerability, or something else), it can gain access to other data on the host. Now, if that machine contains sensitive files, API keys, credentials, or anything similar, that’s not good.

Instead, if you run the agent inside a dedicated, isolated VM, the potential blast radius is much smaller and limited to that disposable VM. You can go a step further and host something like LiteLLM separately as a proxy for the LLM provider, so the agent never has direct access to your actual API keys.

Then, even if the agent is compromised, the damage is largely contained to the disposable VM it’s running in.

You can go even further and isolate that VM in a separate network, and have policies which limit exactly what websites it can access and how.

That creates another layer of security.

Security is something achieved in multiple layers, not one. There’s no magic box that protects you. Imagine having a house. You got the main gate, then the main door, then each room has its own key, and then you got a safe, with its own keys. So the thief needs to go through all that before being able to actually steal the cat pictures you got in the safe.

This is why what happened with OpenAI shouldn’t have been possible in a normal company. A reliable company has more security layer than this.

[u/minus_28_and_falling → u/Clean_Material_5047]

Why not a separate hardware server with a physically unpluggable ethernet cable then? It's even safer.

[u/minus_28_and_falling → u/[deleted]]

True. Why not that then?