Priya Subramaniam

Sandbox lock-in compounds invisibly through isolation, state formats, and orchestration layers.

Most "persistent" sandboxes only deliver two of three properties agents actually need.

How frameworks route untrusted agent code to isolated execution environments.

Running untrusted C code requires hardware virtualization, not containers.

Shape of demand, not volume, determines whether a sandbox platform survives production scale.

Setting timeout policy wrong costs money, leaks resources, and creates security exposure.

Untrusted AI code requires kernel isolation that standard containers can't provide.

Faster starts don't guarantee better isolation—the tradeoff matters more than the benchmark.

Malicious tenants can steal secrets from sandbox neighbors by exploiting shared hardware.

AI agents breach memory limits in seconds, while cgroup v2 was built for predictable workloads.

Layering filesystem controls stops AI-generated code from reaching files it shouldn't.

AI pipeline images need multi-layered scanning beyond standard container tools.

Catch vulnerable container images before they reach production.

Trivy's supply-chain attack exposes why scanner provenance matters more than features for AI teams.