AWS Kiro Ships Local Sandbox, Enforcing Kernel-Level Isolation to Shield Developer Credentials From AI Commands
shashib · x · 2026-10-16
AWS made command sandboxing generally available in Kiro's IDE and CLI (minimum versions 1.3/2.31) on October 14, bringing the isolation Kiro Web has offered in the cloud since May to developer laptops.
The problem: agent commands ran with the developer's own privileges, with human per-command approval as the only guard — a control that breaks down on long tasks or when nobody is watching. Kiro's own example: permission rules blocked the file-reading tool from /.ssh and /.aws, yet a shell script could still read the same credential files.
The fix: kernel-level OS enforcement — Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows. Writes stay within the project directory and temp space, the kernel refuses reads of popular credential paths, and network traffic passes through a local proxy.
The author notes the sandbox ships off by default, and that where the agent sits relative to the sandbox determines what still requires manual checks.
Related event: AWS Kiro launches OS-level local sandbox to contain AI coding agents(3 posts)→
More from coding & agent
- Dev spins up full k8s cluster inside sandboxes via new LAN feature, runs agent experiments unattended — willcb · 2026-10-17
- Factory AI makes Delegations generally available for handing work to Droid — matanSF · 2026-10-17
- SandMatter co-founder: a convincing final answer isn't enough to ship an agent — VariousMechanic5811 · 2026-10-17
- Pest-Control Engineer Falls for OpenClaw, Buys Mac Studio Mid-Road-Trip — heyneighbor · 2026-10-17
- Consumer agents creating virtual cards on their own BIN means users lose credit card rewards — km · 2026-10-17
- He's reverse-engineering Grammarly with Perplexity's new REA skill and 10K free credits — ChrisUniverse · 2026-10-17