I have this nagging feeling with these kinds of agentic cloud products (and there seem to be so many these days): the promise is secure (as in isolated) workflows, but it’s unclear what that means when so many of the workflows themselves are privileged.
Or in other words: I often struggle to see the security value of a VM that I’m just going to load all of my sensitive credentials into anyways (since the agent needs them). The usability argument seems strong, but the security argument seems to hinge on me treating my local machine as a sort of bastion host, which I don’t think is generally true.
(This isn’t to denigrate the work itself: it seems very good. But it also seems like we’re still groping around a very weak definition of “security” for agentic workflows.)
With sandboxes you give your agent just what it needs and nothing more, not the whole suite of secrets living in your environment that could be exfiltrated
I think traditional sandboxes are not going to be the correct abstraction. I’ve been messing around with building harnesses based on object capabilities and being able to limit exactly what a page can access in what manner will be the way forward
I use codex in a VPS that I consider disposable in case it accidentally rm -rf /. The main goal for me is I don't want to babysit approvals but at the same time I don't want the AI running on the same computer I keep things like my irreplaceable photo albums etc. If it somehow breaks my VPS and takes it all down it doesn't matter I just reload from a backup.
> I don't want the AI running on the same computer I keep things like my irreplaceable photo albums etc.
If your computer really does contain irreplaceable photos, you need to back them up immediately. An AI is very much not the only thing that could cause your data to be deleted.
---
...I feel kind of bad about this comment, half of me feels like I'm being a smart aleck and shouldn't post it, but the other half feels like it's a real point. Nothing irreplaceable should exist only on your machine, so what is the boundary?
I have been building Odokai https://odok.ai to solve the problem you describe @woodrufw - visibility and ownership of the entire AI stack for customers.
11 comments
[ 39.2 ms ] story [ 1361 ms ] threadOr in other words: I often struggle to see the security value of a VM that I’m just going to load all of my sensitive credentials into anyways (since the agent needs them). The usability argument seems strong, but the security argument seems to hinge on me treating my local machine as a sort of bastion host, which I don’t think is generally true.
(This isn’t to denigrate the work itself: it seems very good. But it also seems like we’re still groping around a very weak definition of “security” for agentic workflows.)
If your computer really does contain irreplaceable photos, you need to back them up immediately. An AI is very much not the only thing that could cause your data to be deleted.
---
...I feel kind of bad about this comment, half of me feels like I'm being a smart aleck and shouldn't post it, but the other half feels like it's a real point. Nothing irreplaceable should exist only on your machine, so what is the boundary?
Note: I work at Docker