I have to say I’m a bit skeptical. The problem with a sandbox that executes arbitrary code (which is what this is; convert a request into code and execute it i

I have to say I’m a bit skeptical. The problem with a sandbox that executes arbitrary code (which is what this is; convert a request into code and execute it in a restricted runtime), is that if you expose APIs in that sandbox that can “do things”, then you have to be extraordinarily careful with your security policies to allow “good actions” and deny “bad actions”. The side channel attacks are a good example; what if fetching an external url is the task you want an agent to perform? How do “know” in your security policy what a good url is and what a bad one is? What if the action is to apply a change to a database element? How does your security policy know how to only allow “good” updates? Certainly you can hand craft guard rails (security policies), but at the end of the day you’re no closer or further than any other environment where you’re executing arbitrary code; it just takes different efforts to find the holes in those security policies and apis. Ie. it’s easy to say “if you write a good sandbox and covert your LLM request into code and run it in the sandbox you’re fine”. …but you’re as fine as your sandbox is; if your goal is a sandbox with holes in it for privileged actions; guess what, the arbitrary code you run in it can call those privileged actions. Certainly the data provenance is a cool idea, but I foresee see a lot of “but but but…” when people try to enforce the boundaries in practice.