Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Agent Safehouse – macOS-native sandboxing for local agents

agent-safehouse.dev

Post reply on HN
Print view View original

171–180 of 207 posts

Re: Agent Safehouse – macOS-native sandboxing for local agents

#171

Post by hmokiguess »

paxys wrote: post #101

Not sure I understand this. Agent CLIs already use sandbox-exec, and you can configure granular permissions. You are basically saying - give the agents access to everything, and configure permissions in this second sandbox-exec wrapper on top. But why use this over editing the CLI's settings file directly (e.g. https://code.claude.com/docs/en/sandboxing#configure-sandbox... )?

I think the idea here is to move the responsibility layer away from the agent, rather than trust the CLI will behave and have to learn specific configs for each (given OP's tool works for any agent, not just Claude), this standardizes and centralizes it.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#176

Post by TheTaytay »

rvz wrote: post #98
e1g wrote: post #81

Earlier quoted context omitted.

Yes, for about a decade. But it’s available everywhere, and still works - and protects us - like brand new!

It's quite naive to assume that. There is a reason why it is deprecated by Apple. Apple is likely preparing to remove it for a secure alternative and all it takes is someone to find a single or a bunch of multiple vulnerabilities in sandbox-exec to give a wake up call to everyone why were they using it in the first place. I predict that there is a CVE lurking in sandbox-exec waiting to be discovered.

Is there a better alternative on Mac?

Re: Agent Safehouse – macOS-native sandboxing for local agents

#177

Post by TheTaytay »

mikemcquaid wrote: post #135
pash wrote: post #36

Sandvault [0] (whose author is around here somewhere), is another approach that combines sandbox-exe with the grand daddy of system sandboxes, the Unix user system. Basically, give an agent its own unprivileged user account (interacting with it via sudo, SSH, and shared directories), then add sandbox-exe on top for finer-grained control of access to system resources. 0. https://github.com/webcoyote/sandvault

Yeh I came here to post this. I preferred this approach as user permissions are a bit easier to consistently verify as a second layer of defence. I also found the author to be helpful and responsive and the tool to be nicely minimalistic rather than the usual vibe coded ever expanding mess. ‘brew install sandvault’ and running ‘sv’ should get you going. (full disclosure: I created the Homebrew formula and submitted a…

Means a lot coming from you - thanks for taking the time to post, and for taking the time to make the Homebrew formula. (I am also a fan of the author's (webcoyote's) other work.)

Re: Agent Safehouse – macOS-native sandboxing for local agents

#179

Post by Tadbitrusty »

One thing I kept hitting when running agents in sandboxed environments — they lose access to reliable system time too. datetime.now() returns whatever the container thinks, which drifts. Built a small external endpoint for this (SpyderGoat) after an agent made decisions based on completely wrong temporal context. Sandboxing the environment is step one; giving the agent reliable ground truth: for things like time is step two.

Re: Agent Safehouse – macOS-native sandboxing for local agents

#180

Post by schmuhblaster »

andybak wrote: post #50
zmmmmm wrote: post #38

This is great to see. I honestly think that sandboxing is currently THE major challenge that needs to be solved for the tech to fully realise its potential. Yes the early adopters will YOLO it and run agents natively. It won't fly at all longer term or in regulated or more conservative corporate environments, let alone production systems where critical operations or data are in play. The challenge is that we need a m…

> solved Have you considered that it's unsolvable? Or - at least - there is an irreconcilable tension between capability and safety. And people will always choose the former if given the choice.

I am experimenting [0] with compiling markdown to a DSL first. Then running a static analysis on the DSL code. Still at an early stage though.

[0] https://deepclause.substack.com/p/static-taint-analysis-for-...

Post reply on HN