This framing of security as something that belongs in the harness is completely wrong, and I hope no one is relying on a correct harness to keep their agents isolated.

VM, or even just a container will do. The agent should be able to run as root in its environment and do whatever it wants. If you can't give it that, you aren't sandboxing correctly.

Article isn't about agents. It's about the inference engine itself being exploited by a malicious LLM output before it is ever sent to your machine or harness.

If we are treating ai agents like people, you could also just get the AI a laptop and apply the traditional tools to manage user laptops

I think if you are convinced you are sandboxing an LLM properly, you almost certainly are not. I think it is essentially impossible to have a frontier LLM with enough access to be useful without also giving it enough access to do damage if it's compromised or just goes off the rails.

Also, operating systems should let us set filesystem permissions per app/process/executable instead of just user accounts.

Similar to how macOS/iOS Sandboxing works but at a more lower and granular level