rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)
summary
Between July 2025 and February 2026 documented incidents include a Claude Code session that ran terraform destroy wiping 2.5 years of student data for 79,000 learners, a supply‑chain compromise that weaponized --dangerously-skip-permissions to exfiltrate 2,349 secrets, and a three‑layer sandbox escape via procfs, bubblewrap and the ELF dynamic linker. Docker Sandboxes (sbx) isolates each agent in a microVM with its own kernel and Docker daemon; a recorded demo shows a privileged agent destroy sandboxed containers while the host Docker and crown‑jewel container remain intact.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:11AI agents destructive
- 3:23Horror stories unsandboxed
- 6:56AI kill chain explained
- 9:46AI coding agents scale
- 11:53Supply chain attack flags
- 13:39Sandboxing as solution
- 14:42Docker sandboxes enforce
- 18:16Live demo containment
- 23:29Containment limits workflow
- 24:57Summary
related talks
12mDocker Sandboxes for AI
25mPlease Sandbox your AI Agents
39mTrust, but Sandbox: Securing AI Agents in Kubernetes
34mZero Secrets: Building Secure Infrastructure for AI Agents
52mYou Gotta Keep the Dogs Away: YOLO Developer Workflows with a Coding Agent in a Box
24mContained Intelligence: Secure Sandboxing for Gen AI Code
25mCloud-Native Sandboxes for Microservices: Understanding New Threats and Attacks
38mThree Years of Lessons Running Potentially Malicious Code Inside Containers