How two engineer side projects became the agent taking action inside Dropbox

The agent in the new Dropbox experience can change people's files without holding the keys to them. According to Dropbox, each conversation runs in its own virtual machine, an isolated computer simulated on Dropbox's servers, while credentials and permission checks sit in a separate process outside it, and every file version the agent writes is recorded against the conversation that produced it, so that conversation's work can be undone on its own (Dropbox tech blog). Dropbox engineers Daniel Reiter Horn and Rich Chan built the design by combining two side projects: a sandbox with 3D modeling software that Horn used to design a printable cityscape, and an agent interface inside the Dropbox desktop app that Chan used to turn receipt images into expense reports.

The virtual machine gives the agent a Linux command line, so it can run existing programs such as document converters and image tools instead of Dropbox building a separate integration for each kind of task. It has no general internet access. Its outgoing requests pass through a proxy to a process called host_tools, which checks that the destination and operation are allowed and, for file changes, that the person has granted permission, and only then attaches the credentials. Because those checks run outside the virtual machine, the agent cannot grant itself wider access. Dropbox says the same holds when it swaps in a different agent harness, the software that connects a model to the machine and manages its work, since the new harness inherits the checks without being rebuilt.

People approve the work at two levels. For a broad request, the agent must first propose a plan and is blocked from asking for file permissions until the person accepts it; when it then needs to change a folder, the app shows an Allow or Deny card. Undo is tied to conversations because of a problem Horn hit with his prototype: when he used Dropbox Rewind to back out a failed design, he had to take care not to also undo unrelated changes made in the same period. Undo now selects only the file versions recorded against the chosen conversation, and if a person or another agent has edited an affected file since, Dropbox saves the restored version as a separate, renamed copy so their work is kept.