.png)
Every Workload is Untrusted
Start building your architecture like it.
Whitepaper
Running Untrusted Code and AI Agents in Production
AI ended the ship-to-prod-and-patch-later era, and every agent you deploy runs one kernel bug away from everything else on the node. Thinking Outside the Sandbox is the architectural security model for running untrusted code, AI agents, and multi-tenant workloads: assume breach at the runtime layer and isolate every workload in hardware.
Thinking Outside the Sandbox
Building Infrastructure in the Age of Untrusted Software and AI
Every platform running code it didn't write will eventually hit a code-execution bug. What decides whether that's an incident or a headline is how far it gets. This white paper is written for platform and security architects running AI agents, third-party code, or multi-tenant workloads in production, and it lays out an architecture that contains the breach instead of trying to prevent every one.
Inside:
- The four untrusted layers running in every production environment: autonomous AI agents, AI-generated code, open-source dependencies, and end-of-life "zombie" software.
- Why a shared Linux kernel is not a security boundary, and how a container escape becomes a node-to-cluster escalation.
- Where BeyondCorp and BeyondProd stop, and why the runtime layer needs BeyondSandbox.
- Four design principles for hardware-isolated runtime, mapped to a build–deploy–run architecture you can operationalize.
Frequently Asked Questions
It's an architectural model that assumes the code running in production is already compromised. Rather than policing untrusted code with software controls inside a shared kernel, it isolates every workload in its own hardware-enforced boundary so a breach can't leave it.
Containers share the host Linux kernel. Namespaces and cgroups are process-isolation primitives, not security boundaries, so a single kernel exploit lets an attacker escape the container and reach the node, neighboring workloads, and attached GPUs.
BeyondCorp secured the network and BeyondProd secured the service. Both assume workloads can be compromised but still rely on a shared kernel to enforce isolation. Thinking Outside the Sandbox extends the same assume-breach logic down to the execution boundary itself.
A Zone is a container-native microVM. Edera runs standard OCI containers and Kubernetes pods inside Zones powered by a memory-safe, Type-1 Xen hypervisor, giving each workload an independent guest kernel fully isolated from the host.
No. Edera runs standard containers and pods with no changes to developer workflows. The isolation happens at the runtime layer, underneath the orchestration you already use.
Additional Resources
A Curated Collection of Musings & Research
Beyond the Safeguards: What Open-Weight AI Models Mean for Security
Containers Don't Contain: Edera's CTO Alex Zenla's Session on MicroVMs and the Hugging Face Breach
You're already running untrusted workloads: Test one node of Edera today
YOU KNOW YOU WANNA
Talk to an Expert
Bring us your architecture. Multi-tenant GPU, untrusted agents, compliance boundaries a shared kernel can't defend. Let's make it secure by design.