Separating the agent from its sandbox limits security risks

Transcript

From the transcript Latent Space publishes with the episode.

1. 1:03:20

   Then related to the compute problem is the sandboxing problem. Mm-hmm. Uh, people have trouble containing agents in sandboxes. Yep. They keep breaking out. [laughs] Yeah. Uh, what's going on there? What's the state of the art? [laughs] Yeah. The state of the breakout recently. [laughs] Yeah. It's interesting. One of the things that we did with Cloud managed agents specifically is the way that we architected it.

2. 1:03:39

   We put out this blog post at the time of launching where we talked about we have the brain separate from the hands, and what that means is, like, the harness runs on a durable server, really ours, right? And then- Oh, wow, neat. Nice, nice pull. Nice pull. Yeah. No, yeah. That's great. Um, and the hands are, it's like a- Perfect... execution environment, like a sandbox or some sort of container, right?

3. 1:03:58

   The part of the reason why we did this was for, like, latency and reliability and these sorts of things, right? Like, if the harness is just running on a durable server and it's only spawning a sandbox or a container to execute when it needs it, that means we can get you tokens back really quickly on your initial request. It means that your sandbox can die, but, like, your whole agent doesn't die because the harness is durable and over here and the har- you know, the agent's storing state separately also.

4. 1:04:21

   And there was a whole product development journey that we went on to get there because our first iteration of an API for agents was just, like, throw cloud code in a sandbox and, like, shove an API on top. And the reason why we didn't launch that as our, like, durable scalable solution is everything that I just said. It was like you've got to boot a sandbox and boot cloud code before you can even get a token back, right?

5. 1:04:41

   The sandbox dies, and you lose your whole agent, and so reliability wasn't where we wanted it to be. So we architected this way mostly for reliability and latency. But the interesting thing, there's actually a, a... The product manager, uh, who worked on this from the very beginning was like, "The most important property of this architecture is security." And everyone was like, "Yes, yes, yes, but latency and reliability."

6. 1:05:01

   [laughs] And, like, now we're like- Now they're vindicated. I literally, I apologized to this person yesterday. I was like, "I'm now, like, telling everybody- I understand... who I meet [laughs] about what you've been saying for months," that, um, nobody was, was as excited about as, as this person was. But one of the more important properties of this architecture is you have credentials for any, any work that the agent needs to execute, right?

7. 1:05:24

   Like, if you're gonna go talk to an MCP server or if you're gonna go, like, use a CLI or call some API, whatever you might wanna do, right? And, like, you need to authenticate those things. You need to store those credentials somewhere so that the agent can use them. And the way that we architected this was we have a totally separate vault where those credentials are getting stored, and as once the agent decides, like, I'm gonna go and call out to one of these services, the agent only ever sees, like, a placeholder, right?

8. 1:05:53

   And, like, on egress, we have a proxy that goes and, like, pulls the right credential out and injects it and lets that out. And so what's interesting about that is, like, the agent is never, like, in the same place where the credentials are, right? Because in the old world of, like, just boot the agent in a box and, like, let it run, you had to send credentials in there, and then you're, like, doing some sort of, like, ah, how do we, like, scrub this and that and make sure that, like, the agent can't take that credential and go do something that it shouldn't be doing.

9. 1:06:21

   It is just, like, literally a, like, literal infrastructure wall [laughs] that says the agents, like, can't access those credentials and can't do anything bad with them. So that was one thing that was really great. The other nice thing is, like, on that sandboxing infrastructure, we can make sure that we have really great egress controls. So we have, like, domain allow lists and things like that, or you just, like, totally shut off network access so that you can't say, "Okay, agent wrote untrusted code.

10. 1:06:45

    That code executes in sandbox, and that code can, like, reach out to the internet," right? Like, now it only can reach out to where you say it can reach out to. So there's a lot of really great properties around all of this within the architecture and within the way that you can configure your sandboxes that make it so that you end up, like, secure by default. One of the, the things that's starting to happen is as we're talking to customers who are like, "I wanna run agents either for, you know, a product for my customers or internally," but I'm like, you know, hearing about incidents where agents are breaking out of sandboxes and bad things are happening.

11. 1:07:15

    How do I think about these things? I think the two most important things are architecture, so that it's, like, literally impossible for an agent to do something that isn't okay, and the configuration that you have on those sandboxes. And so one of the really, really nice things about Cloud managed agents is you just, like, get that out of the box, and you get something out of the box that, like, as we learn more and we continue to evolve the properties of those systems, you kind of get that for free.

12. 1:07:38

    'Cause I think, say, all the words that just came out of my mouth, like brain and hands and credentials, injection and egress and all these sorts of things are just, like, if you go back, like, nine months, like, no one would be saying these words, right? [laughs] Like, these are all, like, relatively new problems that we're solving, and so, um, we want our customers to be able to take advantage of the solutions to those problems as we're even learning about them and solving them ourselves within our infrastructure.

13. 1:08:01

    Yeah. And internally, we're just upgrading everything to be basically- That pattern Secure by default, yes Yeah But it's better Uh, we, we, we also unlocked, uh, something that we covered in the Tarek pod, which is the cloud brain, local hands- Mm-hmm...