--- schema: 1 type: video title: >- Sandboxes Aren't Optional: 4 Ways to Isolate Coding Agents — Robert Brennan, OpenHands description: >- Running your coding agent with --dangerously-skip-permissions on your laptop puts every file, secret and prod credential you have in reach. NEXT UP: AI ENGINEER CODE SUMMIT Join us in SF for the second annual AIE CODE Summit, Nov 10–12, our last flagship summit of 2026. Applications live now: https://aie.codes Robert Brennan, co-founder and CEO of OpenHands, traces AI coding from ChatGPT snippets to local agents and now cloud agents, and argues that sandboxes should follow the principle of least privilege. He compares four real setups: Docker on your laptop, Claude Code in GitHub Actions, a dedicated VM or Mac Mini, and a Kubernetes pod per session. He rates each on local vs remote, scale, isolation, persistence and triggers, covers why sandboxes still aren't a cure-all, and closes with OpenHands Agent Canvas. In this video: • Why local agents with skipped permissions expose everything you can access • Least privilege for coding agents • Trade-offs of Docker, GitHub Actions, VMs and Kubernetes • The limits of sandboxing, including container escapes SPEAKER Robert Brennan, Co-founder & CEO, OpenHands X: https://x.com/rbren_dev LinkedIn: https://www.linkedin.com/in/robert-a-brennan LINKS OpenHands: https://openhands.dev OpenHands (GitHub): https://github.com/OpenHands/OpenHands CHAPTERS 0:00 Intro and OpenHands 0:57 Evolution of AI-driven development 2:27 Moving agents to the cloud 3:32 Risks of running agents locally 4:52 Principle of least privilege 5:42 Local Docker containers 7:02 Claude Code with GitHub Actions 8:22 Dedicated VM or Mac Mini 9:47 Kubernetes pods per session 11:02 Comparing the four strategies 12:22 Sandboxes are not a panacea 13:07 OpenHands Agent Canvas 13:57 Closing Recorded at the AI Engineer World's Fair 2026 in San Francisco. Subscribe for more talks from the engineers building with AI. AI Engineer: https://ai.engineer YouTube: https://www.youtube.com/@aiDotEngineer X: https://x.com/aiDotEngineer LinkedIn: https://www.linkedin.com/company/aidotengineer/ #CodingAgents #AISecurity #AIEngineer canonical: 'https://liquidgold.cc/watch/iH_wV8BbS24' markdown: 'https://liquidgold.cc/watch/iH_wV8BbS24.md' llms: 'https://liquidgold.cc/watch/iH_wV8BbS24/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-23T22:19:01.016Z' language: null children: [] videoId: iH_wV8BbS24 durationSeconds: 863 publishedAt: '2026-10-12T05:10:18.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 23 endSeconds: 60 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=23' heldReason: rights - ordinal: 1 text: null startSeconds: 60 endSeconds: 71 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=60' heldReason: rights - ordinal: 2 text: null startSeconds: 71 endSeconds: 147 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=71' heldReason: rights - ordinal: 3 text: null startSeconds: 147 endSeconds: 157 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=147' heldReason: rights - ordinal: 4 text: null startSeconds: 157 endSeconds: 213 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=157' heldReason: rights - ordinal: 5 text: null startSeconds: 213 endSeconds: 224 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=213' heldReason: rights - ordinal: 6 text: null startSeconds: 224 endSeconds: 300 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=224' heldReason: rights - ordinal: 7 text: null startSeconds: 300 endSeconds: 310 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=300' heldReason: rights - ordinal: 8 text: null startSeconds: 310 endSeconds: 343 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=310' heldReason: rights - ordinal: 9 text: null startSeconds: 343 endSeconds: 353 watch: 'https://liquidgold.cc/watch/iH_wV8BbS24?t=343' heldReason: rights --- # Sandboxes Aren't Optional: 4 Ways to Isolate Coding Agents — Robert Brennan, OpenHands Running your coding agent with --dangerously-skip-permissions on your laptop puts every file, secret and prod credential you have in reach. NEXT UP: AI ENGINEER CODE SUMMIT Join us in SF for the second annual AIE CODE Summit, Nov 10–12, our last flagship summit of 2026. Applications live now: https://aie.codes Robert Brennan, co-founder and CEO of OpenHands, traces AI coding from ChatGPT snippets to local agents and now cloud agents, and argues that sandboxes should follow the principle of least privilege. He compares four real setups: Docker on your laptop, Claude Code in GitHub Actions, a dedicated VM or Mac Mini, and a Kubernetes pod per session. He rates each on local vs remote, scale, isolation, persistence and triggers, covers why sandboxes still aren't a cure-all, and closes with OpenHands Agent Canvas. In this video: • Why local agents with skipped permissions expose everything you can access • Least privilege for coding agents • Trade-offs of Docker, GitHub Actions, VMs and Kubernetes • The limits of sandboxing, including container escapes SPEAKER Robert Brennan, Co-founder & CEO, OpenHands X: https://x.com/rbren_dev LinkedIn: https://www.linkedin.com/in/robert-a-brennan LINKS OpenHands: https://openhands.dev OpenHands (GitHub): https://github.com/OpenHands/OpenHands CHAPTERS 0:00 Intro and OpenHands 0:57 Evolution of AI-driven development 2:27 Moving agents to the cloud 3:32 Risks of running agents locally 4:52 Principle of least privilege 5:42 Local Docker containers 7:02 Claude Code with GitHub Actions 8:22 Dedicated VM or Mac Mini 9:47 Kubernetes pods per session 11:02 Comparing the four strategies 12:22 Sandboxes are not a panacea 13:07 OpenHands Agent Canvas 13:57 Closing Recorded at the AI Engineer World's Fair 2026 in San Francisco. Subscribe for more talks from the engineers building with AI. AI Engineer: https://ai.engineer YouTube: https://www.youtube.com/@aiDotEngineer X: https://x.com/aiDotEngineer LinkedIn: https://www.linkedin.com/company/aidotengineer/ #CodingAgents #AISecurity #AIEngineer Canonical: https://liquidgold.cc/watch/iH_wV8BbS24 · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks --- #### Chunk 0: Document excerpt (0:12 to 1:00) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 1: Document excerpt (1:00 to 2:27) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 2: Document excerpt (2:27 to 3:33) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 3: Document excerpt (3:33 to 5:00) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 4: Document excerpt (5:00 to 5:43) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 5: Document excerpt (5:43 to 7:07) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 6: Document excerpt (7:07 to 8:22) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 7: Document excerpt (8:22 to 9:52) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 8: Document excerpt (9:52 to 11:09) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 9: Document excerpt (11:09 to 12:28) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 10: Document excerpt (12:28 to 13:12) > Held: transcript rights do not permit this chunk's text. --- #### Chunk 11: Document excerpt (13:12 to 14:23) > Held: transcript rights do not permit this chunk's text.