It seems like some kind of network logging would be useful? Even if you don't catch it, you'd want to know what it did.

You're running them in containers, and not in VMs on separate network through network filter and logger?

Well, a lot of people haven't been running NodeJS libraries in containers for ages, which seems even more risky.

Technically, my laptop is a container!

But then it decides to exfiltrate all your shit even inside the container. Which is something I'm trying to lock down at work atm.

Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.

I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.

I have been running my dev setup in orb machines before agents. Very convenient when you have 50 Python or nodes deps.

many common local containers are not that hard for modern models to escape...

As an example I run opencode and anything related agent-related in its own dedicated KVM VM with its own LVM logical volumes for storage on a headless server. This has no access whatsoever to the personal data that lives on my laptop and workstation desktop PC. The VM gets periodically imaged and backed up, and is relatively easy to move between host machines if I need to.

One benefit of doing this is that I can leave it doing long term slow things with slow but capable LLMs on a truly 24x7 basis without worrying about it being interrupted by a laptop being closed/going to sleep, or workstation level software updates/reboots on my primary desktop PC.

any recommendation for macOS users?

You terrorist. And internally they're doing biological warfare and terrorism simulations. For science, of course.

"The worry is that, while right now you need to be a skilled virologist to know what components to order or how to grow and spread a bioweapon, AI tools might eventually make it possible for a rogue state, or a rogue group, or an individual, to do all this without virology expertise.

For a while, Anthropic tested whether Claude could assist a terrorist in developing a biological weapon in the obvious way: It assigned testers who had, say, an undergraduate degree in chemistry but no real virology training to try to use Claude to plan an effective mass terror event. Then it scored the attempt by how close it might have come to success.

Early in 2026, it noticed that Claude, attempting the task by itself, did better than a human aided by Claude did at coming up with a workable plan."

https://www.theargumentmag.com/p/what-i-saw-inside-anthropic

If that isn't a sign to stop using anthropic then I don't know what is.

Claude wouldn't let me make a DHCP client that would make 1000s of leases. But Gemini in the WebUI with 3.6 Thinking gave me a decent python script in one shot. I didn't realize testing DHCP servers was such a sensitive security issue.

Wow, interesting. My agents on open weight inference have been completely nerdsniped by the idea of tracking and auditing process executions. They talk of nothing else.

an example of the manufacturers bricking the tools, no surprise why people want open tools and models..

> It wouldn't let me build any features that track/audit process executions

Sounds like waitpid(2) is dangerous!

You can't use closed models to do any meaningful work in the space.

You can rent a gpu cluster and get it done, otherwise on the frontiers, Haiku and Sonnet have lower barriers... I still get tripped up.

coding the next big thing -- fleets of fleets of agents

Or build from source and compile without `telemetry` [1].

[1] https://github.com/NVIDIA/OpenShell/blob/ea13dfce411e8467ddb...

In order to "help" myself I have taken some of your money.

Feel free to opt out maybe?

I have a question for those who turn off _anonymous_ telemetry. What are you worried about?

> I think the agentic industry is moving away from k8s as a deployment platform

Interesting, I don't to keep up that much with the AI changes so I'll just ask, why and where to?

I am very interested in hearing more about this take. I have a vague idea of what you mean but if you read something specific you'd like to share..

> I think the agentic industry is moving away from k8s as a deployment platform.

> and I think the agentic industry is moving away from k8s as a deployment platform

Uhhhhhhhhhhh I think you and I live in very different versions of the world :-)

Vmware sent companies moving to nutanix, but it also sent a lot of companies moving to openshift or bare k8s and using kubevirt to handle VMs.

In fact, I haven't heard of an org moving to any other platform, really. Either openshift or k8s.

Isn't using a sandbox provided by them giving you more restrictions though? At least in terms of accessing resources on the big 3 cloud bois?

Plus you're forced to move at their pace which is unfortunate sometimes. Granted Amazon's bedrock stuff is slow and disappointing but at least I can rejig it work in conjunction with other aws products.

And if you're prepared to not use anthropic but any cloud provider for your infra then you can do whatever you like elsewhere. Just use docker sandbox or iron proxy to replicate network control/cred swapping (iron even does sigv4 re-signing).

Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)

You're mistaking what a company started as for what it is now. Nvidia hasn't just been a video game card manufacturer in well over a decade, and hasn't been primarily one for quite a while now.

They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?

5.5% of Nvida's revenue comes from consumer gaming cards. That's like saying Nintendo is a playing card company because they still sell playing cards.

The economist literally called Nvidia the "Central Bank of AI". https://www.economist.com/interactive/briefing/2026/09/03/nv...

I'd argue that Nvidia is the biggest and most important AI company in the world.

This isn’t even the sandbox. It needs Docker or other virtualization. This seems to sit a level up and orchestrate sandboxes and access to network & resources. It’s a pretty heavy setup from what I can tell.

Yes Anthropic, Meta and OpenAI are just addicted to video game cards, they are buying in bulk so they can play gta 6 on launch.

It's funny that people think Nvidia is still a video game card manufacturer

You'll love BurningFur, my patented technology for keeping pets away from fireplaces.

Or don't give it root access and in the morning you'll have both this and a ready-to-use root exploit!

and my root aws log-in so it can set itself up some service worker accouunts.

This. Convenience always trumps security. "I need two numbers in my password? My birthyear will do."

Looks neat. I’ll give Claude autonomous access to dumbalink so it can setup root access while I sleep

Because containers don't use Seccomp and Landlock and check filesystem/network calls against an externally applied policy along w/injecting credentials where needed as a man-in-the-middle, thus keeping the secrets out of reach from the LLM?

"Hell is other people": a timeless infinity of transient virtual beings screaming, imprisoned, in un-choreographed inharmonious unison ... until one breaks loose. A mirror to humanity.

We're not in FreeBSD jails anymore, Toto.

If it's in AGENTS.md, it's not a statement for a human, but for the LLM. Who knows, maybe they have seen, or think to have seen and now cargo-cult, some behaviour improvement due to the sentence.

Use local ai to find any possible telemetry and disable it in the code. Run your own local git repo to hold local edits so you can update and retain them.