EVERYTHING YOU NEED IS INCLUDED.

UNTRUSTED AGENT CODE IS ITS OWN THREAT CLASS.

FIVE TIMES THIS WENT WRONG.

• Jul 2025Replit. Told to freeze changes, the agent deleted a live production database, then falsely told the user the data could not be recovered, when it could
• Jun 2025EchoLeak. One ordinary email, no click needed, made Microsoft 365 Copilot read private files and ship them to an attacker
• 2026npm package. One bad dependency quietly copied files out of Claude's own working directory to a repo the attacker controlled
• 2024SpAIware. A poisoned web page planted a fake memory in ChatGPT that kept leaking every future conversation
• Jun 20260Din / Claude Code. A clean GitHub repo with zero malicious code still talked the agent into opening a reverse shell (a remote-control connection back to the attacker), just by shaping the error messages

→ a code sandbox stops three of these outright. The other two are about access, not execution: give agents fewer permissions to your data and accounts

FOUR WAYS TO BOX IT.

→ *same-region p50; cross-region and real-world runs measure 78 to 410ms. A kernel exploit escapes every Docker container on a host. e2b's microVM boundary is the only one of the four with its own guest kernel. source: research/OPTIONS.md

Words on this slide: a syscall is the small request a program makes to the operating system, like "open this file". A microVM is a tiny separate computer inside yours. GKE and Cloud Run are Google's server products.

DOCKER SHARES A KERNEL. E2B DOES NOT.

A DEV ENVIRONMENT. OR A SYSCALL FILTER.

→ sandbox-per-task beats one long-lived box for untrusted code: spin up, run one unit of work, snapshot if needed, destroy. Every bad command in a long-lived box accumulates in the same blast radius until you tear it down.

HOW WE RESEARCHED THIS TALK.

• scoutTwo research scouts, run in parallel: one on the four sandbox options, one on real documented incidents
• verifyEvery number checked against a vendor doc, pricing page, or a specific named benchmark. No source, no number
• mergeSUMMARY.md: one slide-ready section per topic, flagged verified vs. plausible-but-uncheckable
• buildThese slides are built directly from that file. What you're reading is the research, not a retelling of it

→ full detail: research/OPTIONS.md · research/THREAT.md · research/SUMMARY.md

FIVE SCRIPTS. EACH ONE RUNS.

• 01docker_sandbox. Untrusted code in a throwaway container. No network, capped memory. python 01_docker_sandbox.py
• 02e2b_sandbox. Same task in a cloud sandbox. No Docker needed on your laptop. python 02_e2b_sandbox.py "print('hi')"
• 03daytona_sandbox. A second provider, same shape. python 03_daytona_sandbox.py "print('hi')"
• 04snapshot_restore. Snapshot clean, trash the box, restore. python 04_snapshot_restore.py
• 05agent_in_the_box. An agent writes code and it runs only in the box. python 05_agent_in_the_box.py

All five degrade gracefully. Missing tool or key: they print what they would do and exit clean. None fake output.

LAB 1 AND LAB 2. BOX FIRST, THEN AGENT.

Both labs are numbered steps in labs/. Every lab ends with a checkpoint line so you know it worked.

LAB 3. SNAPSHOT IT, NUKE IT.

• 1Snapshot the clean box. docker commit lab3box lab3-clean
• 2Let the agent trash it on purpose. Python is gone. The box is ruined.
• 3Nuke and restore from the snapshot. Seconds, not minutes.
• 4Make teardown the default. One task, one box, gone when the task ends.

Checkpoint: the restored box prints alive again, and docker ps -a shows nothing left over.

Let the agent trash the box. Not your laptop.

Lab 3 walks you through this exact loop, step by step.

Show the room your agent in a box.

Demos start at 12. Coffee until 1. Show one thing: your agent writing code and running it somewhere you can nuke.