World's Fair 2026
From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI
Overview
This talk explores the design principles behind creating secure and scalable agent sandbox clouds. It begins by explaining why AI models need the ability to execute code or use tools to handle tasks with verifiable rewards, such as math and coding problems. The presentation then delves into the evolution of sandbox technologies, from basic process isolation to advanced virtualization, emphasizing the critical need for robust security to protect against malicious or overzealous code execution in both research and product environments.
Who should watch
- AI Engineers and developers building or integrating AI agents.
- Product Managers and designers evaluating the feasibility and security of AI-powered features.
- Infrastructure engineers responsible for deploying and managing AI workloads.
- Anyone interested in the security implications of running untrusted code at scale.
- Builders seeking to understand the trade-offs between different sandboxing technologies.
Key takeaways
- AI models benefit significantly from tool-calling capabilities, enabling them to solve problems with verifiable rewards more accurately.
- Sandboxing is essential for securely executing untrusted code, protecting both the host system and other users' data.
- Early sandboxing methods like fork/exec are simple but insecure and prone to resource exhaustion.
- Containers (using namespaces and cgroups) offer improved isolation but still share the host kernel, posing security risks.
- Gvisor provides a user-space kernel to further reduce the attack surface but can still be vulnerable to chained exploits.
- Hardware-assisted virtualization (microVMs) offers the strongest security boundary by isolating the guest kernel in a separate CPU context, making host kernel exploitation significantly harder.
- Persistence through disk snapshotting is crucial for reliability, enabling checkpointing, state restoration, and advanced exploration strategies like Monte Carlo tree search.
- Incremental snapshotting and efficient storage mechanisms are key to managing costs and performance at scale.
Notable quotes
*The key unlock was that given the model tool calling capability or a way to execute code the model gets these verifiable reward questions around code and math correctly.*
*Security is a spectrum. You can still get a decent amount of protection from containers.*
*My view is that security like system tricks can cover performance issues, but they cannot hide security breaches.*
Unofficial community note. Prefer the recording for nuance.