Comment by mfro

I haven't gone to network filter and logger yet, but I'm running mine in a VM, using lima (https://lima-vm.io/) to make it painless. Works on Mac and Linux, has an untested Windows version.

I run mine on an abacus.

So far I've settled on one jumbo VM with many Incus containers inside. Nothing goes inside the VM that I can't afford for agents to exfiltrate. I've been really happy with this setup.

I’d like to know more about your use case, could you tell us more? And are there any specific tools you find useful here?

I ask because I’ve found that as isolation increases, so does friction, and then of course capabilities.

For real.

My agentic workloads happen on two physical machines dedicated only to agentic workloads that share a VLAN with only eachother, with single token access to the specific repositories they are meant to push to and limited scope, hard limited credentials pulled from the hardware store on hardware token/fingerprint request only.

I view the safety around unmonitored agentic work in a similar way to how I view working with viruses or bacteria in a disease lab.

This stuff isn’t magic, it isn’t intelligent, but it is dangerous and needs to be handled with careful intent.

Something like this would even be useful for npm etc.

And most people running containers are running a default docker/containerd setup, which does not actually isolate you from anything at all in the first place anyways.

We successfully airgapped AI. It's only on earth.

You have an ephemeral laptop?

Been thinking about this a lot lately, and it’s a surprisingly difficult problem.

All it needs is public access to anything it can have the tiniest effect on, and it can exfiltrate data. Something as simple as a read count on some obscure forum post would be enough, albeit very slow.

You would need a human reviewing every single action of the agent to prevent them from exfiltartimg data. There are just too many possible side channels for a predefined solution. I believe currently what you want is a locally hosted decision model scoring every agent action againt a set of rules with a human in the loop once the decision model isnt 'confident' the actions are harmless.

I've been thinking a lot about this problem. Also, I think like the idea might be to look at the issue with code mode. Like basically, we know that all agents can write bash and execute it and that is what agents default code mode is.

But like if you only allowed for example JavaScript code that could be executed in a WASM sandbox, then you would have better control instead of just locking down with proxies. Basically there would be a very large API, basically tools, that the agent would codemode execute. My guess is that this would need a tool router to optimize the loading of these into the context. But it would give you very fine control over what code execution can and cannot be done.

[flagged]

smol machines: https://github.com/smol-machines/smolvm

slim, fast, microvm that runs on every platform.

disclaimer: am author

Orbstack, no contest