Luke Hinds

Streaming tomorrow: Agent Sandboxing with "nono". Co-founder @decodebytes joins me as we dig into how it works, how to restrict single commands, agent harnesses, tool calls, and egress filtering URLs, e.g. blocking GitHub write access. Click "Notify me" on YouTube to ping you when we go live #devsecops #agenticdevops youtube.com/live/qZ2AOZjSm…

Interested in Agent Identity - and more importantly, how to bind that identity to an agent's actual behavior? Join the @nolabs_ai team as we showcase nono working natively with the SPIFFE/SPIRE identity protocol. 🔒 Phantom Tokens: Host the Workload API outside the sandbox and inject phantom tokens inside—making credential leaks impossible. 📜 Cryptographic Audit: Log every action with verified identity for a complete "flight recorder" audit trail. 👇 Link to join the webinar luma.com/73tz35ak

renames are not easy! but happy with this one.

We are now officially nolabs, inc! Thanks for all the fish, always further, we wish you luck on all your travels!

We just shipped ephemeral micro sandboxed tool execution! A collaborative effort along side smart folks from Datadog and Okta - the first of its kind, you can set a policy for an individual CLI tool execution - demonstration in the link.. youtube.com/watch?v=ndTM1D…

The claude code nono package just passed 50,000 pulls directly into a zero latency sandbox - it is already about to head past 60k. Copied by many, yet rivalled by few - nono pioneered the zero-latency, zero-setup agent sandbox, and continues to innovate and lead the way.

"audit chain is local DSSE+Merkle, not externally anchored (no Sigstore/Fulcio/Rekor despite earlier claim)" - we never claimed it was - sigstore is used for artifact attestation. For the rest, we are a poor fit, we are not providing hardware rooted isolation, we provide fine-grained capability based isolations, something not possible for all the others, who really are microvms wearing a 'I am now an agent sandbox" t-shirts.

9/9 Full June 2026 update. 29 product score cards, threat coverage matrix, interactive composer: ast.georgebuilds.dev github.com/kajogo777/the-… Open source. Feedback, corrections, vendor self-assessments welcome via PR.

1/9 How do you compare AI agent sandbox security across products? Most “sandboxed” claims hide huge gaps. Strong VM isolation but unrestricted network. Or plaintext API keys sitting in env vars. The Agent Sandbox Taxonomy (AST) maps 29 products against 7 defense layers. Here are June 2026 updates to the scoring... ast.georgebuilds.dev

@elinesterov @ycombinator There are loads of them - but they are all in for a rude awakening what they meet disgruntled hard edge product security teams and CISOs who grill them alive.

@decodebytes @ycombinator Any yc portfolio company doing the same thing with sandboxes but for money?

I give up with @ycombinator news - seems so petty to let users just flag you without reason.

I am looking forward to the day where we no longer have frenzied hype play out at whatever new way someone has just discovered at passing markdown files into an API

@elinesterov in nono , the agent / sandbox never gets the real credential - it gets a phantom.

@decodebytes nah, I want my pin for yubikey. If I need to give SSH/PGP keys to the agent, they won't be in HW, most likely.

What is the state-of-the-art signing for agents? I want to distinguish commits made by different agents working autonomously on code, so I can review them via GitHub PRs. Also, how do you communicate? Do you create different users for them? One with different keys?

@elinesterov This is planned work in nono - although I don't have an answer for the yubikey pin - 3d print your finger and put it on one of those pecking bird desk toys? 😀

Also, how to make this work with sandboxes? My keys are on yubikey and require PIN entry; that works fine when I babysit the agent, but I want to see them go brrr cosign and sigstore doesn't work because of private repos @decodebytes any ideas?

@RedHat @nvidia @RedHat_AI I will prep the OpenShell -> nono.sh guide for when you folks eventually need it :)

Red Hat and @NVIDIA are integrating NVIDIA OpenShell into the full-stack @RedHat_AI platform. The work brings oversight and policy to the infrastructure level, while contributing to the open source OpenShell project to standardize how agents are governed on enterprise platforms. Learn more: red.ht/4wVuG9h

Swival gets built-in, first-class support for the Nono sandbox swival.dev/pages/nono.html /cc @decodebytes

Containers share the host kernel by design. For AI agents executing model-generated code, that's a real problem - one kernel exploit reaches the host. New post on Kubefence from @pradipta_kr from @RedHat : stacking Kata Containers + Seccomp + nono into one RuntimeClass. 👇 nono.sh/blog/kubefence…

nono.sh often ends up in comparison articles where its pitched against microVMs, within a very loose rag-tag bunch known as "Agent Sandboxes" - but the truth is, this is like comparing the fly-by-wire limits built into an aircraft control system to an end-of-runway concrete barrier - one governs every control input from within, in real time; the other stops things outside from going wrong when the plane runs out of runway. A microVM guards the host. What happens inside, is not really its concern or duty to protect . If data is exfiltrated to unknown endpoints, destructive tool calls are made, an agent malfunctions and racks up eye-watering LLM api costs, and then deletes your database - you can't really blame the VM. You got what you signed up for - strong, monolithic, isolation. Not internal governance. So nono operates at a completely different point in the security model: inside. It enforces capability-based, fine-grained policy, to intercept sensitive or destructive operations, and it audits what the agent is actually doing with tamper resistant , cryptographic claims (the blackbox recorder!). The question isn't "how contained is the damage" - it's "does the agent get to do this at all, in this particular context." They answer different questions entirely: A VM answers, "if malicious code executes, how do we contain the blast radius from breaching the host and adjacent tenants?" nono answers, "how do I give the agent some authority to use a tool to access AWS credentials and call its APIs, but not allow the same access when its curl using the POST method to send your production credentials in a payload to a public github issue. Docker not long back announced "we launched Docker Sandboxes with a bold goal: to deliver the strongest agent isolation in the market." That's Great! However, it's not really what your AI weary CISO needs to sleep better at night. Instead, it's resolving a problem that's already mostly solved - in a claimed, much stronger way. AI agents aren't highly focused on breaking isolation, something very difficult to achieve; they want to steal keys and cause wreckage from the inside. Want to see what the future malicious agent looks like? Go check out TeamPCP and their recent pursuits - they aren't bypassing hardware-level isolation with a zero-day, they're letting npm install do the job by executing a post-install scripts to exfiltrate your CI tokens. BUT - they also harmonise and are formidable when combined - which is why teams and orgs are now deploying nono directly onto AWS Fargate / Firecracker, and hardened Kubernetes bound images - one holds the perimeter; the other governs what runs inside it. You get to sleep a bit easier at night. If you interested in learning more and working with us to help shape a new approach for a new threat - we are now accepting a limited number of design partners to help us shape the future of AI Agent Security.

Seriously, what is happening at @github - cannot do any work and seriously considering alternatives now.