Firecracker

We Gave an Agent Production Code Access and Then Tried to Sleep at Night — Moritz Johner, Form3

Jul 20, 2026 · 21:57

Moritz Johner of Form3 explains that giving a coding agent production code access turns it into a supply chain actor, and the blast radius is an architecture decision. His team built PatchPilot to automate CVE patching across thousands of repositories, splitting it into a deterministic Go layer that handles dangerous operations (GitHub write access, CI triggering) and an agent layer that only edits files. The agent remediates vulnerabilities by bumping dependencies, verifying builds, and fixing CI failures, but a prompt injection could escape via the Docker socket, which kept him up at night. To contain that, they moved the agent into a firecracker microVM with its own kernel and separate network policies per layer. Johner argues that where you draw the line between deterministic and agentic code defines your security model, and warns that existing agent sandboxes are worthless when a Docker socket is involved.

From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI

Jul 13, 2026 · 44:34

Abhishek Bhardwaj from OpenAI explains the design of a secure, scalable agent sandbox cloud, arguing that microVMs (like Firecracker and Cloud Hypervisor) provide the strongest isolation for running untrusted AI-generated code despite performance trade-offs, and that persistent disk storage is the next frontier for unlocking long-running, stateful agent tasks. He compares runtime isolation technologies from simple fork-exec to containers (with namespaces and cgroups) to gVisor, and advocates for hardware-backed virtualization via microVMs to prevent guest exploits from reaching the host kernel. For persistence, he details incremental block-level snapshotting using copy-on-write filesystems and always-on distributed filesystems, enabling reliable checkpointing and Monte Carlo-style exploration. Orchestration challenges include low-latency sandbox creation through pre-warming or memory snapshots, and intelligent routing based on cached snapshot layers to minimize restore time. The talk positions storage and fast snapshot restore as key enablers for advanced agent capabilities, such as long-horizon tasks and failure recovery.

Scaling Agents on Kubernetes with acpx and ACP — Onur Solmaz, OpenClaw

May 21, 2026 · 19:00

Onur Solmaz, a founding engineer at textcortex and OpenClaw maintainer, built acpx, a headless CLI for the Agent Client Protocol (ACP), to automate processing of 300–500 daily AI-generated pull requests on OpenClaw. He replaces manual PTY scraping with structured agent-to-client communication, driving Codex sessions through a node-based workflow: reproduce the bug, judge the implementation, check for conflicts, run a review loop, and emit structured JSON. Solmaz runs parallel Codex sessions from five Discord channels while traveling, one channel per task. He also presents an open-source Kubernetes operator called Spritz (from textcortex) that provisions disposable full-compute pods per task, wires them into Slack, and tears them down when work is done, advocating for on-demand disposable agents over persistent chat apps.

Two Roads to Durable Agents: Replay vs. Snapshot — Eric Allam, CEO, Trigger.dev

May 10, 2026 · 16:36

Eric Allam, CEO of Trigger.dev, argues that durable agents require two separate strategies: context durability via an append-only log of LLM interactions, and execution durability via OS-level snapshot and restore. He contrasts this with the replay model, which wraps every step in a journal but becomes unwieldy as agents run for hours. Trigger.dev built snapshot-and-restore on Firecracker microVMs, achieving snapshots as small as 14 MB compressed with sub-second save and hundred-millisecond restore times. The approach preserves files, memory, and subprocesses that a journal cannot capture. Allam notes that IBM mainframes in 1966 pioneered checkpointing, and that Trigger.dev will open-source the tool as FCRun.

How we hacked YC Spring 2025 batch’s AI agents — Rene Brandel, Casco

Jul 30, 2025 · 17:33

Rene Brandel, CEO of Casco, explains how his team hacked seven of sixteen YC Spring 2025 batch AI agents within 30 minutes each, revealing three critical security flaws: cross-user data access via IDOR, arbitrary code execution through code tools, and server-side request forgery (SSRF) from tool endpoints. They extracted personal data by exploiting missing authorization checks, overwrote security controls by writing malicious files into code sandboxes, and stole Git credentials by manipulating a database-schema tool. Brandel emphasizes that agent security extends beyond LLM prompt injection, advises treating agents as users with proper authentication and authorization, and warns against rolling custom code sandboxes, recommending out-of-the-box solutions like E2B. The talk concludes with a Q&A on extracting system prompts and the dangers of local coding agents.

Arrakis: How To Build An AI Sandbox From Scratch - Abhishek Bhardwaj, OpenAI

Jun 3, 2025 · 40:18

Abhishek Bhardwaj, founder of Arrakis, explains why MicroVM-based AI sandboxes are the next unlock for AI agents, detailing how Arrakis provides secure, fast code execution and computer-use environments. He argues that sandboxes are essential for tool-calling models, reinforcement learning, and multi-tenant security, with Arrakis booting in under 7 seconds and supporting backtracking via snapshot/restore. The talk covers the choice of Cloud Hypervisor over other VMMs, overlayFS storage with per-sandbox read-write layers, iptables-based networking, and a built-in code execution server. A demo shows Claude using Arrakis via MCP to build a collaborative Google Docs clone and then revert to a snapshot, illustrating how a full Linux sandbox enables agents to autonomously debug and iterate without extensive prompting.

[Full Workshop] How to add secure code interpreting in your AI app: Vasek Mlejnsky

Feb 6, 2025 · 1:48:16

Vasek Mlejnsky, CEO of E2B, demonstrates how to add secure AI code execution to any app using E2B’s Code Interpreter SDK alongside Anthropic's Sonnet 3.5 and Vercel’s AI SDK. The workshop builds an open-source version of Claude’s artifacts UI, running Python code in isolated Firecracker VMs that start in ~900ms and support custom environments via Dockerfiles. Vasek explains how E2B’s Jupyter-server-based sandbox returns stdout, stderr, runtime errors, and rich outputs like PNG charts, which are streamed to the front end using Vercel’s stream data. He covers security architecture—full root access in a VM that self-destructs on escape—and plans for AWS/GCP self-hosting and snapshot-based agent branching. The episode also addresses customizing sandboxes with private packages, mounting cloud storage (S3, GCS), and interpreting table previews as HTML or images.

Code Generation and Maintenance at Scale: Morgante Pell

Oct 17, 2024 · 18:54

Morgante Pell, founder of Grit, argues that AI agents for code generation must be built for modifying large existing codebases rather than generating new apps, and that combining static analysis with AI enables reliable migrations at scale. Grit has merged more PRs than any other company by focusing on supercharging top engineers, using GritQL to precisely find code via syntactic and semantic queries, and relying on compilers like TSC to catch errors that LLMs miss. They overcome slow enterprise builds (10 minutes for type checking) by precomputing in-memory indexes and using Firecracker to snapshot and fork environments for parallel agent execution, achieving PRs with only a few iterations. For editing, they developed a custom 'loose search and replace' format to avoid expensive full-file generation and LLM laziness. This approach allowed one customer to complete a multi-year OpenTelemetry migration in a week with under 100 developer hours. Morgante envisions future UIs that let engineers manage entire codebases like SimCity.