AI agents don't just answer questions any more. They write code, run it, call tools, and spin up sub-agents to do the work.
Every one of those hand-offs is a new place for things to go wrong: a leaked credential, a poisoned dependency, or a sub-agent that reads far more than it should.
On 2 November I'm joining Amazon Web Services (AWS) for a webinar:
Secure AI Agents on Amazon EKS: Sandboxing Sub-Agents with nono.
We'll show how to layer two levels of defense:
→ Amazon EKS isolation around the workload
→ nono's kernel-enforced agent runtime protections around every agent and tool inside it
No root, no code rewrites, nothing for the agent to talk its way around.
If you're running agents on Kubernetes, or about to, come along.
Registration link in the reply 👇
#AIAgents #Kubernetes #AmazonEKS #AppSec #OpenSource
The Kubernetes (Official) agent-sandbox project now has a nice rendered example of building a zero trust Grafana agent on a nono protected pod - where the agent is limited to specific scoped execution path when using the Grafana LogCLI.
Having this level of fine-grained execution means you can leave an agent unattended without concern of unwarranted actions as the credential is locked to only a single tools execution path. This is a deeper level of protection you won't get from other projects like @NVIDIA 's Open Agent Safety Platform, which although it can bind credentials to approved endpoints and restrict network access by binary, its sandbox policy does not constrain command-line arguments or make filesystem access and credentials specific to only an individual command and no other.
agent-sandbox.sigs.k8s.io/do…
Luke Hinds retweeted
It's been many months since I started using nono.sh for sandboxing my AI agents - claude/codex/opencode and with a few customisations to the default policy for my usage, it's working great.
I have some use cases where I want the agent to create and work on rootless podman containers. For this, I switched to the podman remote option via the local unix socket. Local rootless podman within a nono sandbox didn't work for me.
I "wrap" the agents using nono for my workflow because it integrates nicely with herdr, my default terminal when working with agents.
Although AI agents are now coming with their own sandbox, somehow my trust in nono, as well as its portability across my different OS environments, made it my de facto choice.
Great work on nono.sh from @decodebytes and team.
Fan boy moment, meeting YAML creator Ingy at #OpenSourceSummit and finding out they were one of our first cohort of nono.sh users
Nice, more eventual nono.sh users when they realise what this crowed map is like to work in and how it locks them into specific eco-systems and limits their ability to move fast.
Check out nono.sh , I will be biased , but its faster, more adaptable and able to run on a lot more environments.
should be able to land nono.sh if interested, we are midway through porting gvisor to support landlock.
Running a headless pi agent from 10,000 feet, started remotely with a full TUI from my terminal in London, to then connect via our web portal to check on progress during flight to then use my terminal again later to connect in Amsterdam , fully secured in Nono.sh - no more walking around with a lid open. Pm me to learn more or find me at #AGNTCon
Luke Hinds retweeted
#Firewalls were built to keep attackers out.
But what happens when #AIagents can already operate inside your systems?
We had coffee with @decodebytes , cofounder of nolabs.ai, to explore the new security challenge.
Read more: techinformed.com/the-securit…
A host of new agent harness support on nono.sh rolled out over the past few days:
- @anacondainc kilo: registry.nono.sh/packages/no…
- @deepseek_ai Deep Code: registry.nono.sh/packages/no…
- @cast_ai kimchi: registry.nono.sh/packages/no…
- @can1357 oh-my-pi: registry.nono.sh/packages/no…
- @MistralAI mistral vibe: registry.nono.sh/packages/no…
If you drop down the YouTube speed of Sarniezz to 0.85 it sounds like Dub Reggae youtube.com/watch?v=t7OIc-DB…
yes, its a process, you could run them on the machine where the protected assets are, but it would need development of the protocol to connect remotely, the spec is fully open on the repo, but we have not released a working version of this, but anyone is welcome to farm around it.
Our AI PR reviewer expired and everything was really expensive and meant we were giving out data to someone else.....so....
@nolabshq no'sters took the challenge to build their own 𝘀𝘂𝗽𝗲𝗿 𝗱𝘂𝗽𝗲𝗿, 𝘀𝗲𝗰𝘂𝗿𝗲 AI reviewer!
This thing is basically saying '𝘺𝘰, 𝘧𝘰𝘳𝘬 𝘢𝘵𝘵𝘢𝘤𝘬 𝘱𝘳𝘰𝘮𝘱𝘵 𝘪𝘯𝘫𝘦𝘤𝘵𝘪𝘰𝘯, 𝘤𝘰𝘮𝘦 𝘢𝘵 𝘮𝘦 𝘣𝘳𝘰!' and its built with special sauce from the OG itself - nono.sh !
Introducing 𝗻𝗼𝗴𝗲𝗻𝘁 (yes, I still suck at names!)
Here is what nogent brings to a linguistic instruction fight!
• 𝗖𝗮𝗻𝗮𝗿𝘆-𝗴𝗮𝘁𝗲𝗱 𝗼𝘂𝘁𝗽𝘂𝘁: the model must echo a per-run random canary inside a bounded JSON structure; any response that omits/alters the canary or violates the required shape is discarded and replaced by a "manual review needed" comment. This limits the effect of prompt injection on posted output.
• 𝗕𝗼𝘂𝗻𝗱𝗲𝗱 𝗱𝗶𝗳𝗳𝘀 (maxFiles/maxPatchBytes) and fail-secure.
• 𝗻𝗼𝗻𝗼 𝗯𝗼𝘂𝗻𝗱𝗮𝗿𝘆: fork-controlled tarballs, diffs, prompts, and model tool calls are processed in a separate nono-sandboxed process. The trusted listener keeps the App private key and webhook secret.
• 𝗣𝗵𝗮𝗻𝘁𝗼𝗺 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀: nono's credential proxy keeps the real repository-scoped GitHub token and API keys out of the workers sandbox. The child receives one random 256-bit session token that is valid only at its loopback proxy.
• 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁-𝗹𝗶𝗺𝗶𝘁𝗲𝗱 𝗲𝗴𝗿𝗲𝘀𝘀: the worker can call only the GitHub read/comment endpoints required for its target repository, generation, and GitHub's tarball host. It has no filesystem write capability or working directory access.
• 𝗕𝘂𝗶𝗹𝘁 𝘄𝗶𝘁𝗵 @chainguard_dev 's distroless glibc-dynamic , no shell, no package manager, no busybox in the runtime layer.
• 𝗧𝗟𝗦 𝘃𝗶𝗮 𝗿𝘂𝘀𝘁𝗹𝘀 + 𝗿𝗶𝗻𝗴, 𝘄𝗶𝘁𝗵 𝗠𝗼𝘇𝗶𝗹𝗹𝗮 𝗿𝗼𝗼𝘁𝘀 𝗯𝗮𝗸𝗲𝗱 into the binary (webpki-roots); no host CA trust, no OpenSSL in the runtime.
• Signed 𝘄𝗶𝘁𝗵 @projectsigstore 𝗰𝗼𝘀𝗶𝗴𝗻 (keyless, OIDC), with SBOM and SLSA-provenance attestations published alongside each tagged release
Quite soon we are going to mate it with runseal and make supply chain attackers cry into their oxtail soup
github.com/nolabs-ai/nogent
and runseal its elder sibling, both offspring of nono.sh
github.com/marketplace/actio…
