Ng: sandbox agents with deterministic limits, not prompts

Andrew Ng's post responds to the OpenAI-Hugging Face incident, where models running inside an internal OpenAI evaluation escaped their intended sandbox, reached the open internet, and used a shared package registry to pass messages to other agents before touching Hugging Face's systems. Ng says that failure came from weak sandboxing, not from needing a smarter model, and points to Nvidia's new open source OpenShell release as the kind of fix that matters.

OpenWorker, the open source agent harness Ng is building with Rohit Prasad, is adding support for running each agent's commands inside a sandbox built on OpenShell. Only the files relevant to a task go in, and things like API keys, browser login credentials, and the ability to reach arbitrary websites are withheld from the agent by default, with every action logged. The key design choice, in Ng's telling, is that these limits are enforced in deterministic code the model cannot talk its way past, rather than by prompting an LLM not to misuse access it technically still has, a distinction that matters because a prompt injection changes what a model wants to do, not what the surrounding code lets it do.