--- schema: 1 type: video title: >- 1,000 Agent Tasks in a Sandbox: What Breaks When LLMs Run Code — Kevin Orellana, AWS description: >- We pointed a coding agent at our own sandbox overnight and told it to break things. Here's what failed. NEXT UP: AI ENGINEER CODE SUMMIT Join us in SF for the second annual AIE CODE Summit, Nov 10–12, our last flagship summit of 2026. Applications live now: https://aie.codes Kevin Orellana, an engineer on Amazon Bedrock AgentCore, wrapped AgentCore's code sandbox and cloud browser in an MCP server and had a coding agent write and run 1,000 tests across 10 domains, logging results to SQLite. He goes through the failures it found, from image encoding bugs and null bytes to unreadable files and browser memory exhaustion. Then he separates interface-layer bugs from sandbox-layer limits like memory, file permissions, seccomp and eBPF. In this video: • Using a coding agent plus MCP to stress-test your own platform • Why results belong in a database, not markdown files • Interface-layer vs sandbox-layer failures • How sandbox limits decide whether an agent can finish its task SPEAKER Kevin Orellana, Software Engineer, Amazon Bedrock AgentCore LinkedIn: https://www.linkedin.com/in/kevinorellana/ LINKS Amazon Bedrock AgentCore: https://aws.amazon.com/bedrock/agentcore/ AgentCore Code Interpreter docs: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html CHAPTERS 0:00 An agent told to break our sandbox 0:37 Amazon Bedrock AgentCore overview 0:57 Simulating customers with coding agents 1:37 Wrapping the platform in an MCP server 2:27 Generating 1,000 tests across 10 domains 3:02 Test harness and SQLite results 3:47 What the 1,000 workflows covered 5:11 Three failures: encoding, null byte, files 6:11 Interface layer vs sandbox layer 7:51 Code sandbox vs cloud browser failures 9:16 Sandbox primitives: seccomp, eBPF, permissions 10:55 Limits of LLM-generated tests 12:00 Local vs remote agent environments 12:35 SSH access to AgentCore sandboxes 13:25 SWE-bench exploits and broken tools 14:10 Takeaway: fuzz test sandboxes remotely Recorded at the AI Engineer World's Fair 2026 in San Francisco. Subscribe for more talks from the engineers building with AI. AI Engineer: https://ai.engineer YouTube: https://www.youtube.com/@aiDotEngineer X: https://x.com/aiDotEngineer LinkedIn: https://www.linkedin.com/company/aidotengineer/ #CodingAgents #AWS #AIEngineer canonical: 'https://liquidgold.cc/watch/k72eLcYpVys' markdown: 'https://liquidgold.cc/watch/k72eLcYpVys.md' llms: 'https://liquidgold.cc/watch/k72eLcYpVys/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-23T22:18:59.778Z' language: null children: [] videoId: k72eLcYpVys durationSeconds: 919 publishedAt: '2026-10-12T05:36:31.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 12 endSeconds: 23 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=12' heldReason: rights - ordinal: 1 text: null startSeconds: 78 endSeconds: 102 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=78' heldReason: rights - ordinal: 2 text: null startSeconds: 113 endSeconds: 156 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=113' heldReason: rights - ordinal: 3 text: null startSeconds: 189 endSeconds: 200 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=189' heldReason: rights - ordinal: 4 text: null startSeconds: 245 endSeconds: 320 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=245' heldReason: rights - ordinal: 5 text: null startSeconds: 320 endSeconds: 331 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=320' heldReason: rights - ordinal: 6 text: null startSeconds: 376 endSeconds: 388 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=376' heldReason: rights - ordinal: 7 text: null startSeconds: 475 endSeconds: 486 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=475' heldReason: rights - ordinal: 8 text: null startSeconds: 563 endSeconds: 574 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=563' heldReason: rights - ordinal: 9 text: null startSeconds: 666 endSeconds: 725 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=666' heldReason: rights - ordinal: 10 text: null startSeconds: 737 endSeconds: 761 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=737' heldReason: rights - ordinal: 11 text: null startSeconds: 761 endSeconds: 772 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=761' heldReason: rights - ordinal: 12 text: null startSeconds: 807 endSeconds: 818 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=807' heldReason: rights - ordinal: 13 text: null startSeconds: 852 endSeconds: 865 watch: 'https://liquidgold.cc/watch/k72eLcYpVys?t=852' heldReason: rights --- # 1,000 Agent Tasks in a Sandbox: What Breaks When LLMs Run Code — Kevin Orellana, AWS We pointed a coding agent at our own sandbox overnight and told it to break things. Here's what failed. NEXT UP: AI ENGINEER CODE SUMMIT Join us in SF for the second annual AIE CODE Summit, Nov 10–12, our last flagship summit of 2026. Applications live now: https://aie.codes Kevin Orellana, an engineer on Amazon Bedrock AgentCore, wrapped AgentCore's code sandbox and cloud browser in an MCP server and had a coding agent write and run 1,000 tests across 10 domains, logging results to SQLite. He goes through the failures it found, from image encoding bugs and null bytes to unreadable files and browser memory exhaustion. Then he separates interface-layer bugs from sandbox-layer limits like memory, file permissions, seccomp and eBPF. In this video: • Using a coding agent plus MCP to stress-test your own platform • Why results belong in a database, not markdown files • Interface-layer vs sandbox-layer failures • How sandbox limits decide whether an agent can finish its task SPEAKER Kevin Orellana, Software Engineer, Amazon Bedrock AgentCore LinkedIn: https://www.linkedin.com/in/kevinorellana/ LINKS Amazon Bedrock AgentCore: https://aws.amazon.com/bedrock/agentcore/ AgentCore Code Interpreter docs: https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html CHAPTERS 0:00 An agent told to break our sandbox 0:37 Amazon Bedrock AgentCore overview 0:57 Simulating customers with coding agents 1:37 Wrapping the platform in an MCP server 2:27 Generating 1,000 tests across 10 domains 3:02 Test harness and SQLite results 3:47 What the 1,000 workflows covered 5:11 Three failures: encoding, null byte, files 6:11 Interface layer vs sandbox layer 7:51 Code sandbox vs cloud browser failures 9:16 Sandbox primitives: seccomp, eBPF, permissions 10:55 Limits of LLM-generated tests 12:00 Local vs remote agent environments 12:35 SSH access to AgentCore sandboxes 13:25 SWE-bench exploits and broken tools 14:10 Takeaway: fuzz test sandboxes remotely Recorded at the AI Engineer World's Fair 2026 in San Francisco. Subscribe for more talks from the engineers building with AI. AI Engineer: https://ai.engineer YouTube: https://www.youtube.com/@aiDotEngineer X: https://x.com/aiDotEngineer LinkedIn: https://www.linkedin.com/company/aidotengineer/ #CodingAgents #AWS #AIEngineer Canonical: https://liquidgold.cc/watch/k72eLcYpVys · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.