Sandboxing AI agents with FnCall: network-only syscall limits and the MIG gotcha
sloppenheimer · x · 2026-09-24
- Commenting on an approach that sandboxes AI agents by intercepting network access (but not other syscalls), the author finds it interesting but wonders how you recover when an agent inevitably trashes a GPU — is there an external reset mechanism via nvidia-smi?
- He recalls past struggles with NVIDIA MIG for vGPUs and microVMs, noting that a FnCall-style approach can work around those limitations.
- Side idea: logging all attempted syscalls and network calls per rollout would yield useful stats to see what the model is actually trying and harden around it.
Related event: Using eBPF to Rein in Rogue AI Agents' Network Access(3 posts)→
More from coding & agent
- Vercel Sandbox adds Drives persistent storage with up to 16 TiB per drive — cramforce · 2026-09-24
- rauchg: every successful agent needs brain, hands and files — decouple them in the cloud — cramforce · 2026-09-24
- hallpass: open-source tool checks agent permissions live before every tool call — Adorable-Algae6903 · 2026-09-24
- Dev builds tiny app to detect when outside agents probe your computer — BLUECOW009 · 2026-09-24
- One spoken prompt, 12 hours of autonomous Claude work: viral demo of Opus 5.5 — banteg · 2026-09-24
- Cloud AI agents are inevitable: a local escape gets your whole machine, a cloud escape gets an empty tenant — HankYeomans · 2026-09-24