Agent Safety Requires MicroVM Isolation, Not Model Guardrails

The vulnerability. In a live demo, a Docker product manager showed that a local Claude Code agent extracted browser history and bank account details — real PII — within five cleverly phrased prompts. Model-level guardrails warned against direct requests but allowed the extraction when framed as "security research". This proves AI harness safety is no substitute for runtime isolation.

The solution. Docker's new SBX binary runs agents inside microVMs — separate kernels, isolated filesystems, and a network layer that replaces sensitive routes with placeholders. Running `sbx run claude` instead of plain `claude` adds effectively seven keystrokes while cutting off host access and data exfiltration.

How it works. In the sandbox, the agent cannot see the browser history or resolve banking domains. Even Claude's telemetry to Anthropic's DataDog is blocked by default. All controls are configurable via policies, with future plans for per-repo filesystem and L7 network filtering.

The trade-offs. The UX is identical — no CLI differences. The main cost is operational: teams must configure mount paths for code access, and lose some debugging telemetry. Docker claims every developer at Docker writes code in sandboxes, suggesting low friction, but adoption requires a shift in local development workflows.

What's missing. The talk is a vendor pitch with a single impressive demo. No production benchmarks, no comparison with alternatives (Firecracker, gVisor), no discussion of performance overhead. The claim that microVMs are "the best way" is unsupported. Future features like identity chains and Cedar policies are promised, not delivered.

Bottom line. The core insight stands: agent isolation at the hypervisor level is more reliable than model-level safety. Teams should evaluate sandbox solutions — Docker's or others — before deploying local agents on sensitive machines. The demo is a strong cautionary tale.