Sandboxing LLM-generated code - anyone else worried about what agents actually execute?
So i've been going deeper into AI agents lately, specifically ones that generate and run code on your behalf, and something has been bugging me that I don't see discussed enough here.
Most of the agent setups I've tried (Auto-GPT style stuff, some custom things with LangChain, etc.) basically just... execute whatever code the model spits out? Like on your actual machine, with your actual permissions. And we're all just kind of okay with that apparently?
I had a situation a few weeks ago where I was testing a workflow that was supposed to parse some CSVs and it decided to install a pip package I'd never heard of and write to a temp directory. Nothing malicious happened but it made me realize how much trust we're putting in these systems. Especially when you start giving them tool access, to API keys, file system permissions - it gets sketchy fast.
Anyway that whole experience sent me down a rabbit hole looking for agents that take sandboxing seriously. Tried a few things, eventually stumbled on Clambot which runs all LLM-generated code inside a WASM sandbox. So the model can still write and execute code but it's contained - no unrestricted access to your system. It also has this approval flow where you can okay tool access interactively which honestly should just be standard at this point. Been using it mostly through the CLI and Telegram integration for personal assistant type stuff (summarizing youtube videos, fetching web pages, scheduling reminders). Nothing crazy but it's nice knowing it's not just yolo-ing shell commands.
I know OpenClaw and Nanobot exist in a similar-ish space but I haven't seen much discussion about how they handle the execution security side of things. Does anyone know if they sandbox generated code or is it more of a "trust the model" situation?
More broadly - for those of you building or using AI agents that execute code: what's your approach to security? Are you running stuff in Docker containers? VMs? Or just vibing and hoping the model doesn't rm -rf something important?
Genuinely curious because the more capable these agents get, the more this feels like a ticking time bomb that nobody's really addressing.