Why AI agents belong in the sandbox | Darren Shepherd

Why buy a sandbox when you can just launch a container? Darren Shepherd spent years at Rancher building on Kubernetes, so sandboxes looked dumb to him. Then he built his own coding agent to run 15 things in parallel without work-tree chaos, and the most interesting part of it turned out to be a sandboxing system. He had proved himself wrong. The sharp part is where the sandbox boundary goes. The common pattern keeps the agent loop outside and sandboxes only its tool calls. Darren calls that completely flawed, because the loop itself directs code that holds secrets and talks to external systems. His answer: put the agent and its tools in one sandbox, with one policy for secrets and egress. Darren is on X and GitHub at @ibuildthecloud. https://obot.ai/ Where does your boundary sit: around the agent itself, or only around the tools it calls? Why buy a sandbox when you can just launch a container? Darren Shepherd spent years at Rancher building on Kubernetes, so sandboxes looked dumb to him. Then he built his own coding agent to run 15 things in parallel without work-tree chaos, and the most interesting part of it turned out to be a sandboxing system. He had proved himself wrong. The sharp part is where the sandbox boundary goes. The common pattern keeps the agent loop outside and sandboxes only its tool calls. Darren calls that completely flawed, because the loop itself directs code that holds secrets and talks to external systems. His answer: put the agent and its tools in one sandbox, with one policy for secrets and egress. Darren is on X and GitHub at @ibuildthecloud. https://obot.ai/ Where does your boundary sit: around the agent itself, or only around the tools it calls? Show notes, transcript, and links: https://www.wordman.dev/podcast/darren-shepherd-ai-agent-sandboxes/ Key Takeaways A container is not a sandbox. Sandboxes sit one layer up: create, clone, copy files in and out, on a base image that mostly just carries language runtimes. Parallel agents need isolation. Running many tasks at once without Git work-tree chaos means giving each task its own sandbox. Egress is the policy surface, not ingress. Agents sit on the consuming side of services, so outbound traffic is what you control. Keep real secrets out of reach. Hand the agent a fake key with the right shape and swap in the real one at a transparent proxy, where policy and exfiltration checks live. Sandbox the agent loop, not only the tool calls. The loop directs code that holds secrets and talks to external systems, so the agent and its tools belong in one sandbox with one policy. Client-side agent loops beat centralized ones. Server-side provider tools such as web search open exfiltration paths that are hard to reason about. MCP's lasting value is the interface, not the protocol: a contract designed for AI, which is why it fits the enterprise. Output is not progress. Letting a model barf out thousands of lines feels productive until the regressions pile up, and one estimate raised in the conversation puts a skilled engineer's real gain at around 5 to 10 percent. Chapters 00:00:00 Why sandboxes felt dumb 00:01:38 Building a coding agent 00:02:36 Parallelism and work-tree chaos 00:03:25 What a sandbox actually is 00:04:27 Files, secrets, and egress 00:08:20 Tool-call-only sandboxing is flawed 00:12:28 Put the agent in the sandbox 00:13:31 Client-side vs centralized loops 00:14:51 GPTScript, Clio, and MCP 00:20:00 MCP, OAuth, and staying in lane 00:30:01 Without fundamentals, AI gets dangerous 00:35:00 The 100x developer myth 00:40:00 AI is not a compiler 00:45:01 Distributed systems instincts 00:51:09 ADRs and keeping quality 00:55:04 Regression holes with agents 00:57:19 Model personalities and greenfield work 01:01:50 Skills as behavioral scripts 01:05:16 Plan-first and spec-driven development 01:12:30 Claude Code and tooling shifts 01:21:16 Wrap and finding joy with AI Mentioned Obot AI Obot on GitHub Model Context Protocol GPTScript (archived) Clio (archived) Rancher Kubernetes Claude Code Codex CLI Architecture Decision Records EP. 22 with Dillon Mulroy