AWS Kiro ships local sandbox that kernel-enforces isolation for AI-run commands and credentials
shashib · x · 2026-10-15
On October 14, AWS made command sandboxing generally available in the Kiro IDE and CLI, bringing the isolation Kiro Web has offered in the cloud since May to developer laptops.
The problem: agent commands previously ran with the developer's own privileges, and the only control was a human approving each command — which breaks down on long tasks or when nobody is watching. Kiro's own example: permission rules blocked the agent's file-reading tool from /.ssh and /.aws, yet a shell script could still read them.
How it works: OS-level enforcement via Seatbelt on macOS, bubblewrap on Linux, and AppContainer on Windows. Writes are confined to the project directory and temp space, the kernel refuses reads of common credential paths, and network traffic passes through a local proxy. The piece notes that where the agent sits relative to the sandbox still determines what needs manual checking. Requires Kiro IDE/CLI versions 1.3/2.31 or higher, on by default.
Related event: AWS Kiro adds OS-level local sandbox to isolate AI coding commands(2 posts)→
More from coding & agent
- One-man software factory: 5-10 parallel agents build POCs, 60% get killed — Stefania_druga · 2026-10-15
- Huawei's SwarmRSI: evolving agent swarms achieve recursive self-improvement in science — Qianru Meng · 2026-10-15
- Prompt With Love: Steering Massive Agent Swarms With Values, Culture and Story — liminal_bardo · 2026-10-15
- Vibe First, Validate Fast: One Chart Nails How AI Development Differs From Agile — burny_tech · 2026-10-15
- A Year of Agent Memory Evolution: From Static CLAUDE.md to "Dreaming" — mcraddock · 2026-10-15
- patio11 on multi-agent dev: clearly the future, and we'll buy so much inference — IgorCarron · 2026-10-15