Anurag Singh writes about combining Claude Code's Auto mode with deny rules and ask rules to eliminate the need to manually approve every command. The setup lets Claude Code work uninterrupted in the background while hard-blocking destructive commands like force-pushes and rm -rf, and optionally prompting on risky-but-acceptable actions like git push.
- Deny rules are enforced by Claude Code itself rather than being instructions to the model, so they hold even in bypassPermissions mode
- A deny list can never be exhaustive; Claude could accomplish the same destructive action through a different tool (e.g., Python instead of rm)
- The built-in sandbox is a stronger safety net than any deny list, though it becomes tedious for projects depending on local databases, Docker, or private registries
- Permission rules are evaluated in fixed priority order: deny first, then ask, then allow
- Deny rules are enforced by Claude Code itself rather than being instructions to the model, so they hold even in bypassPermissions mode
- A deny list can never be exhaustive; Claude could accomplish the same destructive action through a different tool (e.g., Python instead of rm)
- The built-in sandbox is a stronger safety net than any deny list, though it becomes tedious for projects depending on local databases, Docker, or private registries
- Permission rules are evaluated in fixed priority order: deny first, then ask, then allow
Leela Kumili writes about DoorDash's Flux platform, which moved LLM-based coding agent workloads from developer laptops to cloud infrastructure, automating 130,000 engineering tasks in a single month and supporting over 25,000 automated code reviews per week. The platform was built after local execution hit limits on power, uptime, and security, and is organized around four primitives: Firecracker microVM sandboxes, an in-house MCP gateway, YAML-defined playbooks, and multiple invocation surfaces (Slack, GitHub, cron, CLI, conversational interfaces).
- Sandboxes achieve a 95th percentile SLO under 5 seconds for full setup, including microVM start, repo clone, build tool install, and agent harness configuration.
- Playbooks can mix agent-driven steps with deterministic code where predictable execution or validation is required.
- The Agent Gateway enforces scoped permissions and logs all agent activity for auditing and policy enforcement.
- DoorDash switched Slack integration from private channels to public threads so engineers could observe agent executions and see how other teams delegated work.
- Sandboxes achieve a 95th percentile SLO under 5 seconds for full setup, including microVM start, repo clone, build tool install, and agent harness configuration.
- Playbooks can mix agent-driven steps with deterministic code where predictable execution or validation is required.
- The Agent Gateway enforces scoped permissions and logs all agent activity for auditing and policy enforcement.
- DoorDash switched Slack integration from private channels to public threads so engineers could observe agent executions and see how other teams delegated work.
Lizzy Li writes about the new custom visualizations framework for Dashboard Studio, introduced in Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, which replaces the legacy framework with a modern sandboxed iframe architecture, simplified JSON-based configuration, and a full CLI/SDK development pipeline supporting React, TypeScript, and watch mode.
- Legacy framework required touching four separate files to add a single configurable option; the new framework consolidates this into a single config.json
- A custom-visualization-builder skill (available in Splunk Agent Skills on GitHub) can scaffold, implement, build, and package a visualization from a data shape description
- Splunk recommends rebuilding important Classic custom visualizations with the new framework rather than relying on backward-compatibility rendering
- Legacy framework required touching four separate files to add a single configurable option; the new framework consolidates this into a single config.json
- A custom-visualization-builder skill (available in Splunk Agent Skills on GitHub) can scaffold, implement, build, and package a visualization from a data shape description
- Splunk recommends rebuilding important Classic custom visualizations with the new framework rather than relying on backward-compatibility rendering
OpenSandbox is a general-purpose sandbox platform for AI applications offering multi-language SDKs, unified sandbox APIs and Docker/Kubernetes runtimes for use cases like coding agents, GUI agents, evaluation, code execution and RL training. It provides SDKs, CLI and MCP integration, a sandbox protocol for custom runtimes, built-in environments such as command, filesystem and code interpreter, network ingress/egress controls, credential vault injection and strong isolation via gVisor, Kata Containers and Firecracker.
- Release images published to Docker Hub, GHCR and Alibaba Cloud with Cosign signatures and provenance
- SDKs for Python, Java/Kotlin, TypeScript/JavaScript, C#/.NET and Go
- OpenSSF Best Practices badge and CNCF Landscape listing
- Release images published to Docker Hub, GHCR and Alibaba Cloud with Cosign signatures and provenance
- SDKs for Python, Java/Kotlin, TypeScript/JavaScript, C#/.NET and Go
- OpenSSF Best Practices badge and CNCF Landscape listing
E2B is an open-source infrastructure designed to run AI-generated code in secure, isolated cloud sandboxes. It provides JavaScript and Python SDKs for starting and controlling these environments, as well as a specialized Code Interpreter SDK for advanced code execution tasks. The project supports self-hosting on AWS and Google Cloud via Terraform and is built to support enterprise-grade agents.
>"Pillar Security's research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes, one write-up a day."
This article details a hands-on experience with Nvidia's NemoClaw, a security-focused stack designed to enhance the safety of the OpenClaw AI platform. While NemoClaw introduces improvements like a sandbox model and aggressive policy filtering, the author finds it still falls short of being a reliable solution.
Bugs, limitations, and the inherent risks associated with OpenClaw's architecture—particularly its connection to external services—persist. The core issue remains that NemoClaw can secure the agent but cannot protect against malicious instructions embedded in external data sources like emails or messages.
The author concludes that while NemoClaw is a step forward, it doesn't fully address the fundamental security concerns surrounding OpenClaw.
Bugs, limitations, and the inherent risks associated with OpenClaw's architecture—particularly its connection to external services—persist. The core issue remains that NemoClaw can secure the agent but cannot protect against malicious instructions embedded in external data sources like emails or messages.
The author concludes that while NemoClaw is a step forward, it doesn't fully address the fundamental security concerns surrounding OpenClaw.
OpenShell is a safe, private runtime environment designed for autonomous AI agents. It provides sandboxed execution with declarative YAML policies to control file access, data exfiltration, and network activity. Built with an agent-first approach, OpenShell offers pre-built skills for tasks like cluster debugging and policy generation.
Currently in alpha, it focuses on single-player mode and aims to expand to multi-tenant enterprise deployments. OpenShell uses a containerized K3s Kubernetes cluster for isolation and enforces security across filesystem, network, process, and inference layers. It supports agents like Claude, OpenCode, and Copilot, managing credentials securely.
Currently in alpha, it focuses on single-player mode and aims to expand to multi-tenant enterprise deployments. OpenShell uses a containerized K3s Kubernetes cluster for isolation and enforces security across filesystem, network, process, and inference layers. It supports agents like Claude, OpenCode, and Copilot, managing credentials securely.
OpenSandbox provides a secure and isolated runtime environment for running commands, filesystems, code interpreters, browsers, and developer tools. It offers multi-language SDKs, unified APIs, and supports various AI workloads like coding agents, browser automation, remote development, AI code execution, and RL training.
OpenSandbox is a general-purpose sandbox platform for AI applications, offering multi-language SDKs, unified sandbox APIs, and Docker/Kubernetes runtimes for scenarios like Coding Agents, GUI Agents, Agent Evaluation, AI Code Execution, and RL Training.
