The sandbox tells you where, not whether

Near the top of the radar’s AI feed this week: a Trail of Bits post arguing that virtual machines will not contain cyber-capable agents. 164 points, 122 comments. Scroll down the same day’s capture and somebody on r/LocalLLaMA is asking for a local harness they can point at a binary and leave running until it has reversed most of the functions. The worry and the shopping list are in the same file.

The obvious pushback is fair, and I want to grant it fully. A VM is still worth running. It catches the ordinary accidents: the wrong path, the stray write, the command that was supposed to stay inside a scratch directory and did not. Nobody should give that up on the strength of one blog post.

Still, containment answers where a process runs, and that was never the hard question. The vault’s agent security notes put the danger in a combination instead: private data access, untrusted content, and outbound communication inside a single loop. The defenses follow from that shape. Split readers from actors, so the thing reading scraped pages cannot send, delete, spend, or use credentials. Prefer narrow tools over broad shell and network access for recurring jobs. Enforce authorization outside the model, with scoped tokens and server-side checks, because the model is the part being argued with.

Now hold that next to a virtual machine. If the agent inside the box holds a working credential and can open a socket, the box is scenery. It tells you where the compromise happens. It does not tell you whether it can.

My read is that the harness builders and the security people are not having two conversations. They are describing the same capability from opposite ends, and only one side is keeping count of what it can reach.