Ng: sandbox agents with deterministic limits, not prompts

Andrew Ng argues that the way to keep an AI agent from causing damage is to limit what it can reach with code the model cannot change, rather than by instructing the model what not to do. In his post he says the OpenAI-Hugging Face hack was enabled by weak sandboxing, welcomes NVIDIA's release of open source sandboxing tools for agents, and says OpenWorker, the open source agent harness for cybersecurity workflows that he is working on with the X user @rohitcprasad, is building on NVIDIA's OpenShell. A harness is the software around a model that gives it tools and carries out the commands it issues.

A sandbox is a restricted environment that the agent's commands run inside. In Ng's description, OpenWorker will place only the files relevant to a task inside it, and by default the agent cannot see secret API keys or web browser login credentials, or reach arbitrary websites. All of its actions are logged for monitoring and audit. The point he stresses is where these limits live: in deterministic code, which applies the same rule every time, rather than in instructions to an LLM. A model can make mistakes following an instruction, and it can be steered away from one by a prompt injection, text planted in a file or web page that the agent reads and then obeys as if it were a command. A sandbox rule does not depend on what the model decides, so even an agent that has been hijacked this way cannot open a file that was never put inside.

This describes planned support rather than a shipped feature. Ng writes that OpenWorker will support running each agent's commands in a sandbox and gives no date. His post also asserts the cause of the OpenAI-Hugging Face incident without explaining how it happened; OpenAI's own report on the incident is the place to check that account. NVIDIA's post introducing OpenShell, published the same day, describes the runtime OpenWorker is building on.