Why I don’t want AI agents executing code in someone else’s cloud
AI agents are getting access to increasingly powerful tools. They can execute code, query databases, call APIs, work with files, and potentially interact with production infrastructure. That’s useful, but it also creates a question I kept coming back to: Where should that execution actually happen? A common answer is a hosted sandbox. Send the task somewhere, let the agent execute it in an…
Artificial intelligence agents now possess the capability to execute code, interact with databases, communicate with APIs and even potentially access production infrastructure. While this offers convenience, it also raises questions regarding where the execution should take place. A prevalent solution involves utilizing a hosted sandbox where the task is sent to be executed in an isolated environment, and the result is subsequently retrieved.
However, once an AI agent starts interacting with credentials, customer data, internal APIs or production systems, the default approach becomes less appealing to the author.
Isolation is a significant concern, as the execution environment should ideally reside on infrastructure that the agent's owner controls. Beyond isolation, network access is another crucial factor. A container isolated from the internet or internal services may still perform a significant amount of activity. Consequently, the author advocates for a more cautious default: no network access unless it is explicitly granted.
This paradigm shift changes the model from "let the agent perform actions while trying to limit the dangerous aspects" to "begin with minimal permissions and specifically grant what is necessary."
Additionally, the author emphasizes the importance of auditability. Simply knowing that an agent utilized a tool may not be sufficient in the event of an issue. Knowing the exact command executed, its parameters, the timing of the action, and the result becomes imperative, particularly when agents are granted access to real infrastructure.
To address these concerns, the author initiated the development of VaultRun, a self-hosted runtime for AI agents. This runtime allows agent workloads to execute on the agent's owner's infrastructure, with each session isolated within a Docker container. Network access is disabled by default, actions are recorded in a signed audit trail, and the runtime can be accessed through APIs and Multi-Cluster-Pod (MCP).
While the author acknowledges that self-hosting does not guarantee the security of AI agent execution, they believe that having control over the security boundary is preferable. However, the author also acknowledges that self-hosting does not automatically ensure security, and there are numerous other complex issues surrounding credentials, permissions, container escapes, policies, replay, secrets, and the scope of access granted to the agent.
VaultRun is currently in an early stage, and the author aims to build it publicly to explore the right boundaries for AI agents. The right level of isolation may differ depending on the workload; for instance, an agent generating throwaway code is vastly different from one that can query a production database or deploy infrastructure.
The author is interested in learning how other developers approach this challenge and would appreciate insights on what additional considerations would be necessary to trust an AI agent executing code or interacting with internal systems near production environments.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
