Open-Source Agent Chimera: Tool Whitelist + gVisor Sandbox
Federal-Teaching2800 · reddit · 2026-07-06
The creator of the open-source agent Chimera shared two security governance updates: First, a per-session tool whitelist (--allow-tools) ensures unauthorized tools never enter the model schema, preventing the agent from being tricked into calling them. Second, the sandbox switched to the gVisor runtime (runsc), using a user-space kernel to intercept container syscalls and reducing the host kernel's attack surface. The author also acknowledged limitations: the whitelist is opt-in by default, gVisor is still not a full VM, and this does not solve the core reliability challenges of agents.
More from coding & agent
- UCSB CS Prof. Xifeng Wang lands 3 grants worth $180K+ for practical agentic AI research — xwang_lk · 2026-10-27
- Gen games don't need to be realtime — turn-based interactivity works, devs argue — djcows · 2026-10-27
- Player rebuilds Street Fighter II in HD with Claude: $3,000 of tokens, 3 weeks — Fantastic-Jeweler781 · 2026-10-27
- How to ace the "send us something cool" AI interview: research interviewers with agents, then focus — brandon_galang · 2026-10-27
- Give AI a clean personal-data-free machine with full control: agents running 24/7 teach you more than any course — EXM7777 · 2026-10-27
- 20 papers across 6 areas to master production-grade agentic AI engineering — MaryamMiradi · 2026-10-27