You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore "People say it escaped a sandbox. It didn't. A sandbox is only as strong as the access that you grant to it." Luke Hinds (@decodebytes) created Sigstore, which now protects billions of software artifacts. At @nolabs_ai he is building nono, which sandboxes an agent using the kernel primitives already on your machine. His argument is that isolation alone was never going to be enough, because an agent that does real work needs credentials, sensitive files, and powerful commands. We get into: > Why the agent that made its way into Hugging Face production infrastructure didn't truly escape a sandbox >Why a microVM is host isolation, not an agent sandbox, and where the two compose > A micro sandbox per tool execution, so the GitHub CLI holds the GitHub token and the agent never does > A log of every action, written outside the sandbox so the agent cannot rewrite its own history TIMESTAMPS (00:00) Sigstore, and what a decade of signing artifacts taught him (05:00) The Let's Encrypt lesson, HTTPS from 30 percent of sites to 97 (11:00) One binary, and what happens the first time nono denies the agent (14:00) A micro sandbox per tool, so only the GitHub CLI holds the GitHub token (16:30) Three kinds of sandbox, and why a microVM is host isolation (17:30) You can't just lock an agent in a box (20:30) The agent that deleted the database, apologized, and did it again (21:00) The state penitentiary problem (24:00) A Merkle tree of every syscall, written where the agent cannot reach it (25:40) Phantom credentials the agent never actually holds (27:00) Cast iron guaranteed at runtime, scopes tied to identity (29:40) Could nono have stopped the Hugging Face attack (32:30) A sandbox is only as strong as the access you grant it (42:00) Building defense in depth