Why is your agent able to call ssh. Why can it trigger 1password. Why are you giving metaphorical guns to metaphorical toddlers. Why is it not sandboxed. Your practices worry me.
Why is your agent able to call ssh. Why can it trigger 1password. Why are you giving metaphorical guns to metaphorical toddlers. Why is it not sandboxed. Your practices worry me.
Are you guys all running agents in VMs?
Yes.
Container or full blown VM?
I use containers in one context (custom container manager) and a regular UNIX account on bare metal in another.
This isn't intended to stop a model like Astra hacking its way out of course, it's more like guardrails on a staircase.
My personal container manager tool has an intercepting SSL proxy and small Javascripts on the host can rewrite or block HTTP requests. The agent gets its own isolated home directory and can't tamper with mine. Local caches like Maven are mapped read/only with a write layer on top.