Sandboxing Is the Easy Part: Our "Pick Your Sandbox" Webinar Replay

"Sandbox" might be the most overloaded word in infrastructure right now. Everyone's shipping one. Almost nobody agrees on what it means, and the teams buying them often can't tell you what their trust boundary actually is.

So we got three people in a room to argue about it.

In our latest webinar, Pick Your Sandbox, Edera Founder and CTO Alex Zenla sat down with Jon Ceanfaglione, Principal at Sparrow Labs, and Tim St. Clair, CEO of Raikiri, to work through a deceptively simple question from a previous session: how do you actually pick a sandbox? Getting there meant answering a harder one first. What does isolation even mean?

Turns out that's where most of the disagreement lives.

Everyone Agrees There's a Problem. The Fix Is the Fight.

The panel opened on the state of security, and the mood was bleak in a useful way. The volume and severity of CVEs has hit a level the panelists called unprecedented, and the bar to exploit them has collapsed. The old assumption that only nation-state actors could chain serious attacks is gone. Anyone can now, and AI has made it faster.

Then there's the second problem stacked on top. Agents are untrusted actors we've invited inside the boundary. We hand them credentials, autonomy, and standing access, and we do it because stopping to approve every action makes the technology unusable. That tension between autonomy and containment ran through the whole hour.

If you've read our take on why the era of "detect and respond" is insufficient for container security, the framing will feel familiar. You cannot patch your way out of a problem moving this fast. You assume compromise and architect to contain it.

What Does "Isolation" Even Mean?

This was the crux, and the answers were sharper than the usual hand-waving.

For Jon, isolation has a hard definition: the thing you're worried about can't reach the shared kernel everything else runs on. Anything short of that is mitigation. You should be able to run workloads side by side and be fully confident there's no escape and no lateral movement.

Tim pushed on the edges. Even with a Type-1 hypervisor, parts of the hardware stay shared. Cache is the obvious one. The panel got into scheduler latency and other covert channels, the noisy-neighbor problems that quietly become communication vectors. His working definition: isolation means you share as little as possible, by design.

That maps directly to how we think about the shared kernel as the real problem in container security. If your architecture requires you to trust the workload to keep its guarantees, you don't have isolation. You have a strongly worded comment in the kernel source.

The Line That Sums It Up

The takeaway Jon left on the table is the one worth sitting with: sandboxing is the easy part.

There are real options now. gVisor, Kata, Edera. People are finally paying attention to the containment layer. But containing the workload is table stakes. The hard parts are the layers around it. Every agent needs a scoped identity and authorization it has to earn. Credentials need to be genuinely least-privilege, not "least" in name only. Egress has to be controlled when you can't reasonably pre-approve every call by hand. And monitoring has to be built in from the start instead of bolted on after.

We've made this exact argument about why sandboxing alone doesn't cut it for AI agents in production. The microVM matters. It's one important piece of a much bigger equation.

Watch the Full Replay

We're not going to spoil the best parts, including the OpenAI cache side-channel story, the New Mexico hospital that turned away ambulances, and whether "Vuln Zero" is real or a fever dream.

The full conversation runs about an hour and is worth every minute if you're responsible for running agents or untrusted workloads in production.

FAQ

What is an AI agent sandbox?

An AI agent sandbox is an isolation boundary meant to limit the blast radius when an agent executes untrusted or unexpected code. The important distinction is where the boundary sits: process-level controls on a shared kernel, or VM-level isolation where each workload gets its own kernel.

Is sandboxing enough to secure AI agents?

On its own, no. Sandboxing contains the workload, but production security also depends on scoped identity, least-privilege authorization, credential rotation, egress control, and monitoring. Containment is one layer of defense in depth.

What does isolation mean in container security?

True isolation means a workload cannot reach the shared kernel or other workloads, with no path for escape or lateral movement. Controls that depend on predicting attacker behavior, like seccomp, AppArmor, and capabilities, are mitigation rather than isolation. For the deeper version of this argument, see what a hardened runtime actually is.

What's the difference between a microVM sandbox and process-level isolation?

Process-level isolation uses OS features where the host kernel enforces restrictions, so a kernel vulnerability breaks the boundary. VM-level isolation gives each workload its own kernel, so a compromise in one workload cannot traverse to its neighbors.