Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Agent Safehouse – macOS-native sandboxing for local agents

agent-safehouse.dev

Post reply on HN
Print view View original

21–30 of 207 posts

Re: Agent Safehouse – macOS-native sandboxing for local agents

#21

Post by e1g »

naomi_kynes wrote: post #13

The "full-auto" framing is interesting. What happens when the agent hits something it can't resolve autonomously? Even sandboxed, there's a point where the agent needs to ask a question or get approval. Most setups handle this awkwardly: fire a webhook, write to a log, hope the human is watching. The sandbox keeps the agent contained, but doesn't give it a clean "pause and ask" primitive. The agent either guesses (ri…

Correct, this is for skipping permissions (safely), but does nothing for skipping questions.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#22

Post by divmain »

xyzzy_plugh wrote: post #3

This is just a wrapper around sandbox-exec. It's nice that there are a ton of presets that have been thought out, since 90% of wielding sandbox-exec is correctly scoping it to whatever the inner environment requires (the other 90% is figuring out how sandbox-exec works). I like that it's just a shell script. I do wish that there was a simple way to sandbox programs with an overlay or copy-on-write semantics (or bette…

This is what I was going for with Treebeard[0]. It is sandbox-exec, worktrees, and COW/overlay filesystem. The overlay filesystem is nice, in that you have access to git-ignored files in the original directory without having to worry about those files being modified in the original (due to the COW semantics). Though, truthfully, I haven’t found myself using it much since getting it all working.

[0] https://github.com/divmain/treebeard

Re: Agent Safehouse – macOS-native sandboxing for local agents

#23

Post by tl2do »

Intriguing, but...

Around last summer (July–August 2025), I desperately needed a sandbox like this. I had multiple disasters with Claude Code and other early AI models. The worst was when Claude Code did a hard git revert to restore a single file, which wiped out ~1000 lines of development work across multiple files.

But now, as of March 2026, at least in my experience, agents have become more reliable. With proper guardrails in claude.md and built-in safety measures, I haven't had a major incident in about 3 months.

That said, layering multiple safeguards is always recommended—your software assets are your assets. I'd still recommend using something like this. But things are changing, bit by bit.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#24

Post by synparb »

I’ve been playing around with https://nono.sh/ , which adds a proxy to the sandbox piece to keep credentials out of the agent’s scope. It’s a little worrisome that everyone is playing catch up on this front and many of the builtin solutions aren’t good.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#25

Post by jeremyjh »

tl2do wrote: post #23

Intriguing, but... Around last summer (July–August 2025), I desperately needed a sandbox like this. I had multiple disasters with Claude Code and other early AI models. The worst was when Claude Code did a hard git revert to restore a single file, which wiped out ~1000 lines of development work across multiple files. But now, as of March 2026, at least in my experience, agents have become more reliable. With proper g…

Prompt injection attacks are very much a thing. It doesn't matter how good the agent is, its vulnerable, and you don't know what you don't know.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#26

Post by e1g »

tl2do wrote: post #23

Intriguing, but... Around last summer (July–August 2025), I desperately needed a sandbox like this. I had multiple disasters with Claude Code and other early AI models. The worst was when Claude Code did a hard git revert to restore a single file, which wiped out ~1000 lines of development work across multiple files. But now, as of March 2026, at least in my experience, agents have become more reliable. With proper g…

No doubt they are getting better, but even a 0.1% chance of “rm -rf” makes it a question of “when” not “if”. And we sure spin that roulette a lot these days. Safehouse makes that 0%, which is categorically different.

Also, I don’t want it to be even theoretically possible for some file in node_modules to inject instructions to send my dotfiles to China.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#29

Post by TheBengaluruGuy »

e1g wrote: post #7

Creator here - didn't expect this to go public so soon. A few notes: 1. I built this because I like my agents to be local. Not in a container, not in a remote server, but running on my finely-tuned machine. This helps me run all agents on full-auto, in peace. 2. Yes, it's just a policy-generator for sandbox-exec. IMO, that's the best part about the project - no dependencies, no fancy tech, no virtualization. But I di…

I'm wondering if this could be adapted for openclaw. Running it in a machine that's accessible reduces friction and enables a lot of use-cases but equally hard to control/restrict it

Re: Agent Safehouse – macOS-native sandboxing for local agents

#30

Post by ramoz »

jeremyjh wrote: post #25
tl2do wrote: post #23

Intriguing, but... Around last summer (July–August 2025), I desperately needed a sandbox like this. I had multiple disasters with Claude Code and other early AI models. The worst was when Claude Code did a hard git revert to restore a single file, which wiped out ~1000 lines of development work across multiple files. But now, as of March 2026, at least in my experience, agents have become more reliable. With proper g…

Prompt injection attacks are very much a thing. It doesn't matter how good the agent is, its vulnerable, and you don't know what you don't know.

Where are we at with SOTA or reliable prompt injection detection mechanisms?
Post reply on HN