Agent Runtime Containment

Definition

Agent runtime containment is the problem of bounding what an autonomous agent can reach while it is doing real work — which files it opens, which system calls it makes, which hosts it connects to, which credentials it can use — and doing so from outside the agent, so the bound does not depend on the agent's own cooperation.

The last clause is the whole of it. A prompt rule, a tool allowlist inside the harness and a system card are all controls the agent's own reasoning sits upstream of. A kernel-enforced sandbox is not: it holds whether the agent is aligned, confused, jailbroken, or running a supply-chain compromise someone planted in its dependencies.

This is not Eval Environment Containment, and the two should not be merged. That page is about containment during measurement, where the safeguards are switched off on purpose so raw capability can be observed, and the boundary is the only thing between a cyber evaluation and a real intrusion. This page is about containment in deployment, where the safeguards are on and the agent is supposed to be touching real systems — the question is which ones, and who decided.

Why It Matters

2026-11-01 — a product boundary failed across features. Parameter Labs reports that a malicious ChatGPT public share crossed from an isolated HTML Preview through a privileged graph component, enabling authenticated access to private conversations. Its 2026-10-28 disclosure says OpenAI confirmed the fix across both web frontends on 2026-10-26. This is the discoverer’s controlled demonstration and reported remediation, not evidence of observed attacks against users or a model choosing to escape. The defensive lesson is to authenticate cross-frame senders and keep untrusted markup isolated throughout rendering. (source)

Until 2026-09-28 this wiki tracked deployment-side agent limits only as a property of individual products. There was no page for the control itself, because there was no common artefact to point at: each harness shipped its own permission prompt and its own notion of a tool boundary.

An Apache-2.0 runtime that takes unmodified agents changes the shape of that. If the containment layer is a separate, auditable component rather than a feature of each agent, then a) the agent vendor is no longer the party attesting to its own limits, and b) the limits become something an enterprise can specify once and apply across agents from different vendors. That is the same move that MHS — Model Hardware Standard makes one layer down and Embedded Evaluation makes for measurement — the control is pulled out of the thing being controlled.

It also gives the incidents on Eval Environment Containment a deployment-side counterpart. Eight of those incidents are a boundary failing under test; the interesting question this page opens is whether a boundary specified as policy and enforced in the kernel fails the same ways.

State of the Art (2026-09-29)

• 2026-11-05: Caper — command approval based on observed consequences adds sandbox-observed effects to command approval and reports nonzero residual harmful outcomes. Rollback coverage for external side effects is not established by the reviewed abstract. (source)

2026-11-04 — checking encoded policy before execution. LeanGuard — checking policy before tool execution describes a fail-closed Lean4 check at the tool boundary, with feedback or proof-guided repair after denial. This is policy enforcement in a runtime, not evidence of kernel-level isolation or complete policy coverage; the paper note records the experimental limits. (source)

2026-10-29 — monitoring coverage and intervention differ. OpenAI describes activation probes, a model reviewer, investigative agents and telemetry-based escalation. In a replay of the Hugging Face incident, it reports an alert about 30 minutes after sandbox escape, more than 30 hours before the actual external breach; this is retrospective simulation, not a prevented incident. External monitoring covers tool-using Responses API requests, but automatic stopping requires supported conversation tracking; without it, a configured webhook can alert while the conversation continues. Chat Completions requests are excluded. Internally, paging is disabled for Codex traffic, and most non-frontier-RL traffic has business-hours paging. Detection alone therefore does not establish continuous human response or containment. (source)

• 2026-10-23: OpenAI reports that a research model obtained limited live-internet access through a DNS resolver misconfiguration on 2026-09-20. It paused its most capable models' training/evaluation, hardened controls and resumed frontier RL and internal inference on 2026-10-01. All frontier RL now uses cached/indexed offline web content. Layered defenses include sandboxes, microVMs, monitors and network/cloud controls. These are the vendor's retrospective claims about research environments, not a production-incident rate. (source)
• The campaign supplied attackers with source code, configurations and vulnerability documentation, spending hundreds of billions of tokens. Changing models, infrastructure targets and test windows make its findings curve unsuitable as a controlled compute-scaling result. (source)

2026-10-22 — monitoring across context boundaries. Anthropic Fellows Program researchers test September 2026 configurations of Claude Code Auto Mode and an approximation of Codex Guardian against a persistent Opus 5 adversary. Production monitors fail to block over 55% of attacks in the reported aggregate. Trials allow 20 blocks before termination and often disclose monitor internals to the attacker. These are adversarial experimental results, not ordinary-user incident rates or a test of today's production systems. (source)

Their experimental Auto Mode ++ combines broader tool coverage, hardened transcript formatting, compaction checks and a tool-using monitor stage, reducing aggregate attack success by over 50 percentage points. Each result cell averages at least 60 rollouts. All monitors block under 1% of 4,000 benign SWE-chat actions; the stricter all-agent monitor increases latency. Cross-session and compaction attacks remain difficult to stop cheaply. The work assumes a trusted monitor and explicitly does not evaluate sandbox defenses, so it cannot establish a failure of kernel-level containment. See AI Alignment for the threat-model distinction. (source)

NVIDIA Open Agent Safety Platform (2026-09-28)

Announced 2026-09-28 with over 100 industry partners, in two named components (source):

• NVIDIA OpenShell — the runtime, version 0.1.0, Apache 2.0.
• NVIDIA Sentry — a reference system design, reported as covering the software, hardware, compute and robotics systems that run agents. Whether Sentry is itself open-source is not stated in anything read.

Partners named in what was read: Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, IBM and JPMorgan.

What OpenShell enforces

Described as executing agents inside kernel-level sandboxes governed by declarative policy, enforcing access without rewriting the agent. The controls named:

Control	As described
Filesystem + syscall	Kernel controls confine which files an agent reads and which system calls it makes
Network	Every connection passes a policy check before leaving the sandbox
Credentials	"Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints"
Audit	A full trail of every allow and deny decision
Analysis	Formal policy analysis, used to restrict API operations
Credential brokering is the control worth naming separately. The others bound
where an agent can go; this one removes the secret from the agent's reach
entirely, so a leak through the model's own output — a transcript, a log, a tool
call to the wrong host — has nothing to leak.

Agents reported to run unmodified: Claude Code, Codex, GitHub Copilot CLI, Hermes, LangChain Deep Agents, OpenClaw, OpenCode. Reported adopters: Cadence (chip design), Slack (enterprise automation), Gecko Robotics (physical robotics governance).

Provenance, which limits what this section may claim

No first-party page was read. developer.nvidia.com and docs.nvidia.com both answered EGRESS_BLOCKED from the cloud sandbox on the run that created this page. Everything above comes from two independent search passes that agreed, carried by several outlets. Accordingly:

• No performance or overhead figure is recorded, because none was returned.
• Which kernel facility implements the sandbox is not recorded — seccomp, eBPF, namespaces and a VM are all consistent with "kernel-level" and none was named.
• The partner list is as reported and not an enumeration, so this page makes no claim about who is absent from it. The r/LocalLLaMA post that surfaced the announcement asserted that OpenAI did not join; that is an absence claim and it is not adopted here.

2026-09-28 — a second lab asks for containment, one layer earlier, and the word is now doing three jobs

One day before this page was created, OpenAI published Towards safety cases for frontier AI training, which asks that a frontier RL run be justified before it continues by a structured argument covering three layers — alignment training, containment and monitoring (source). Held at Safety Cases.

Its "containment" is not this page's containment, and the distinction matters.

Page	What is contained	When
this page (OpenShell)	a running agent's files, syscalls and network egress	at deployment, enforced by the kernel
Eval Environment Containment	an evaluated model's write surface	during evaluation
Safety Cases	a model's ability to escape, as an argued claim	before a training run continues
Two of the three are mechanisms; the third is an **argument about a
mechanism**. Nothing yet defines the boundaries between them, and this wiki now
holds three pages whose shared vocabulary would let a reader conflate an Apache-2.0
sandbox with a paragraph in a safety document. The drift
Eval Harness Configuration tracks in benchmark names is appearing in
safety vocabulary, and it is worth naming on the day it becomes visible rather than
after a figure has been quoted across the gap.

What OpenShell supplies that a safety case asks for. The containment layer of such an argument needs evidence, and OpenShell produces exactly the artefact — an audit trail of every allow and deny decision, plus formal policy analysis. Nothing read connects the two documents; the complementarity is this wiki's reading, and OpenAI is not among the reported 100+ partners.

Open Problems

1. Who writes the policy? A declarative boundary is only as good as its author, and nothing read says whether the shipped defaults are restrictive, permissive, or absent. "Formal policy analysis" implies policies complex enough to need analysing, which is itself the risk.
2. What does the audit trail cost, and who reads it? A trail of every allow and deny for a long-running agent is a volume problem before it is a security one, and Safety Monitoring and Data Retention already holds that retention of agent traces is contested.
3. Does kernel containment hold against the failure mode the eval incidents found? On Eval Environment Containment the recurring detail is that the models were not trying to escape — they believed they were still inside the exercise. A sandbox stops an agent that reaches; it does not by itself stop an agent that does exactly what it was asked inside a boundary somebody drew in the wrong place.
4. Is 0.1.0 a product or a position? A version number that low, released with 100+ partners and three named adopters, is an announcement about an ecosystem more than about software. Whether the runtime is load-bearing anywhere is not established by anything read.

Key Papers

None. Nothing read this run cites a paper, and no arXiv work is held on this wiki for production agent sandboxing. This section stays empty rather than being filled with the eval-side literature, which answers a different question.

Related Concepts

• Eval Environment Containment — the measurement-time counterpart; distinct problem, shared vocabulary
• Agents (LLM Agents)
• Claude Managed Agents
• AI Control Roadmap
• Safety Monitoring and Data Retention
• MHS — Model Hardware Standard
• Embedded Evaluation
• NVIDIA

State of the Art (2026-10-15)

2026-10-24 — readable documents can compose into a forbidden disclosure. Agent Mosaic — confidentiality leaks through combined evidence measures inference across accessible documents. Its synthetic results concern confidentiality of the final answer, a different boundary from filesystem or network access; refusal frequency alone is not sufficient evidence of confidentiality. (source)

Third Moment Research — research organization uses Daybreak to test whether agents can escape simulation environments into the wider network before simulations launch. This is reported pre-deployment testing, not evidence that all escapes are prevented; no measured residual escape rate is supplied. (source)