CEO of @nolabshq - Creator of sigstore.dev , now building nono.sh - the agent security platform.
Bristol
- Tweets 3,024
- Following 753
- Followers 3,184
- Likes 3,166
AI agents don't just answer questions any more. They write code, run it, call tools, and spin up sub-agents to do the work.
Every one of those hand-offs is a new place for things to go wrong: a leaked credential, a poisoned dependency, or a sub-agent that reads far more than it should.
On 2 November I'm joining Amazon Web Services (AWS) for a webinar:
Secure AI Agents on Amazon EKS: Sandboxing Sub-Agents with nono.
We'll show how to layer two levels of defense:
โ Amazon EKS isolation around the workload
โ nono's kernel-enforced agent runtime protections around every agent and tool inside it
No root, no code rewrites, nothing for the agent to talk its way around.
If you're running agents on Kubernetes, or about to, come along.
Registration link in the reply ๐
#AIAgents #Kubernetes #AmazonEKS #AppSec #OpenSource
2
1
4
192
The Kubernetes (Official) agent-sandbox project now has a nice rendered example of building a zero trust Grafana agent on a nono protected pod - where the agent is limited to specific scoped execution path when using the Grafana LogCLI.
Having this level of fine-grained execution means you can leave an agent unattended without concern of unwarranted actions as the credential is locked to only a single tools execution path. This is a deeper level of protection you won't get from other projects like @NVIDIA 's Open Agent Safety Platform, which although it can bind credentials to approved endpoints and restrict network access by binary, its sandbox policy does not constrain command-line arguments or make filesystem access and credentials specific to only an individual command and no other.
agent-sandbox.sigs.k8s.io/doโฆ
11
327
Luke Hinds retweeted
It's been many months since I started using nono.sh for sandboxing my AI agents - claude/codex/opencode and with a few customisations to the default policy for my usage, it's working great.
I have some use cases where I want the agent to create and work on rootless podman containers. For this, I switched to the podman remote option via the local unix socket. Local rootless podman within a nono sandbox didn't work for me.
I "wrap" the agents using nono for my workflow because it integrates nicely with herdr, my default terminal when working with agents.
Although AI agents are now coming with their own sandbox, somehow my trust in nono, as well as its portability across my different OS environments, made it my de facto choice.
Great work on nono.sh from @decodebytes and team.
7
2
13
468
Fan boy moment, meeting YAML creator Ingy at #OpenSourceSummit and finding out they were one of our first cohort of nono.sh users
1
7
247
Running a headless pi agent from 10,000 feet, started remotely with a full TUI from my terminal in London, to then connect via our web portal to check on progress during flight to then use my terminal again later to connect in Amsterdam , fully secured in Nono.sh - no more walking around with a lid open. Pm me to learn more or find me at #AGNTCon
1
14
331
Luke Hinds retweeted
#Firewalls were built to keep attackers out.
But what happens when #AIagents can already operate inside your systems?
We had coffee with @decodebytes , cofounder of nolabs.ai, to explore the new security challenge.
Read more: techinformed.com/the-securitโฆ
1
76
A host of new agent harness support on nono.sh rolled out over the past few days:
- @anacondainc kilo: registry.nono.sh/packages/noโฆ
- @deepseek_ai Deep Code: registry.nono.sh/packages/noโฆ
- @cast_ai kimchi: registry.nono.sh/packages/noโฆ
- @_can1357 oh-my-pi: registry.nono.sh/packages/noโฆ
- @MistralAI mistral vibe: registry.nono.sh/packages/noโฆ
1
1
7
512
If you drop down the YouTube speed of Sarniezz to 0.85 it sounds like Dub Reggae piped.video/watch?v=t7OIc-DBโฆ
170
Our AI PR reviewer expired and everything was really expensive and meant we were giving out data to someone else.....so....
@nolabshq no'sters took the challenge to build their own ๐๐๐ฝ๐ฒ๐ฟ ๐ฑ๐๐ฝ๐ฒ๐ฟ, ๐๐ฒ๐ฐ๐๐ฟ๐ฒ AI reviewer!
This thing is basically saying '๐บ๐ฐ, ๐ง๐ฐ๐ณ๐ฌ ๐ข๐ต๐ต๐ข๐ค๐ฌ ๐ฑ๐ณ๐ฐ๐ฎ๐ฑ๐ต ๐ช๐ฏ๐ซ๐ฆ๐ค๐ต๐ช๐ฐ๐ฏ, ๐ค๐ฐ๐ฎ๐ฆ ๐ข๐ต ๐ฎ๐ฆ ๐ฃ๐ณ๐ฐ!' and its built with special sauce from the OG itself - nono.sh !
Introducing ๐ป๐ผ๐ด๐ฒ๐ป๐ (yes, I still suck at names!)
Here is what nogent brings to a linguistic instruction fight!
โข ๐๐ฎ๐ป๐ฎ๐ฟ๐-๐ด๐ฎ๐๐ฒ๐ฑ ๐ผ๐๐๐ฝ๐๐: the model must echo a per-run random canary inside a bounded JSON structure; any response that omits/alters the canary or violates the required shape is discarded and replaced by a "manual review needed" comment. This limits the effect of prompt injection on posted output.
โข ๐๐ผ๐๐ป๐ฑ๐ฒ๐ฑ ๐ฑ๐ถ๐ณ๐ณ๐ (maxFiles/maxPatchBytes) and fail-secure.
โข ๐ป๐ผ๐ป๐ผ ๐ฏ๐ผ๐๐ป๐ฑ๐ฎ๐ฟ๐: fork-controlled tarballs, diffs, prompts, and model tool calls are processed in a separate nono-sandboxed process. The trusted listener keeps the App private key and webhook secret.
โข ๐ฃ๐ต๐ฎ๐ป๐๐ผ๐บ ๐ฐ๐ฟ๐ฒ๐ฑ๐ฒ๐ป๐๐ถ๐ฎ๐น๐: nono's credential proxy keeps the real repository-scoped GitHub token and API keys out of the workers sandbox. The child receives one random 256-bit session token that is valid only at its loopback proxy.
โข ๐๐ป๐ฑ๐ฝ๐ผ๐ถ๐ป๐-๐น๐ถ๐บ๐ถ๐๐ฒ๐ฑ ๐ฒ๐ด๐ฟ๐ฒ๐๐: the worker can call only the GitHub read/comment endpoints required for its target repository, generation, and GitHub's tarball host. It has no filesystem write capability or working directory access.
โข ๐๐๐ถ๐น๐ ๐๐ถ๐๐ต @chainguard_dev 's distroless glibc-dynamic , no shell, no package manager, no busybox in the runtime layer.
โข ๐ง๐๐ฆ ๐๐ถ๐ฎ ๐ฟ๐๐๐๐น๐ + ๐ฟ๐ถ๐ป๐ด, ๐๐ถ๐๐ต ๐ ๐ผ๐๐ถ๐น๐น๐ฎ ๐ฟ๐ผ๐ผ๐๐ ๐ฏ๐ฎ๐ธ๐ฒ๐ฑ into the binary (webpki-roots); no host CA trust, no OpenSSL in the runtime.
โข Signed ๐๐ถ๐๐ต @projectsigstore ๐ฐ๐ผ๐๐ถ๐ด๐ป (keyless, OIDC), with SBOM and SLSA-provenance attestations published alongside each tagged release
Quite soon we are going to mate it with runseal and make supply chain attackers cry into their oxtail soup
github.com/nolabs-ai/nogent
and runseal its elder sibling, both offspring of nono.sh
github.com/marketplace/actioโฆ
2
2
13
655
Had a great time chatting with @vtahowe on the @insecureagents !
You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore
"People say it escaped a sandbox. It didn't. A sandbox is only as strong as the access that you grant to it."
Luke Hinds (@decodebytes) created Sigstore, which now protects billions of software artifacts. At @nolabs_ai he is building nono, which sandboxes an agent using the kernel primitives already on your machine. His argument is that isolation alone was never going to be enough, because an agent that does real work needs credentials, sensitive files, and powerful commands.
We get into:
> Why the agent that made its way into Hugging Face production infrastructure didn't truly escape a sandbox
>Why a microVM is host isolation, not an agent sandbox, and where the two compose
> A micro sandbox per tool execution, so the GitHub CLI holds the GitHub token and the agent never does
> A log of every action, written outside the sandbox so the agent cannot rewrite its own history
TIMESTAMPS
(00:00) Sigstore, and what a decade of signing artifacts taught him
(05:00) The Let's Encrypt lesson, HTTPS from 30 percent of sites to 97
(11:00) One binary, and what happens the first time nono denies the agent
(14:00) A micro sandbox per tool, so only the GitHub CLI holds the GitHub token
(16:30) Three kinds of sandbox, and why a microVM is host isolation
(17:30) You can't just lock an agent in a box
(20:30) The agent that deleted the database, apologized, and did it again
(21:00) The state penitentiary problem
(24:00) A Merkle tree of every syscall, written where the agent cannot reach it
(25:40) Phantom credentials the agent never actually holds
(27:00) Cast iron guaranteed at runtime, scopes tied to identity
(29:40) Could nono have stopped the Hugging Face attack
(32:30) A sandbox is only as strong as the access you grant it
(42:00) Building defense in depth
3
2
7
485
Luke Hinds retweeted
"If anybody's trying to evaluate sandboxes, I'd say those are the three main ones at the moment: Your serverless one, your host isolation microVM, and then really what we do with nono, which is a new category in many ways" - @decodebytes Co-Founder and CEO of @nolabs_ai
You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore
"People say it escaped a sandbox. It didn't. A sandbox is only as strong as the access that you grant to it."
Luke Hinds (@decodebytes) created Sigstore, which now protects billions of software artifacts. At @nolabs_ai he is building nono, which sandboxes an agent using the kernel primitives already on your machine. His argument is that isolation alone was never going to be enough, because an agent that does real work needs credentials, sensitive files, and powerful commands.
We get into:
> Why the agent that made its way into Hugging Face production infrastructure didn't truly escape a sandbox
>Why a microVM is host isolation, not an agent sandbox, and where the two compose
> A micro sandbox per tool execution, so the GitHub CLI holds the GitHub token and the agent never does
> A log of every action, written outside the sandbox so the agent cannot rewrite its own history
TIMESTAMPS
(00:00) Sigstore, and what a decade of signing artifacts taught him
(05:00) The Let's Encrypt lesson, HTTPS from 30 percent of sites to 97
(11:00) One binary, and what happens the first time nono denies the agent
(14:00) A micro sandbox per tool, so only the GitHub CLI holds the GitHub token
(16:30) Three kinds of sandbox, and why a microVM is host isolation
(17:30) You can't just lock an agent in a box
(20:30) The agent that deleted the database, apologized, and did it again
(21:00) The state penitentiary problem
(24:00) A Merkle tree of every syscall, written where the agent cannot reach it
(25:40) Phantom credentials the agent never actually holds
(27:00) Cast iron guaranteed at runtime, scopes tied to identity
(29:40) Could nono have stopped the Hugging Face attack
(32:30) A sandbox is only as strong as the access you grant it
(42:00) Building defense in depth
3
6
1,027
Dissecting the incredibly dumb category of 'agent sandbox'
A stack where everyone makes the wrong assumption when assessing a sandbox - don't make the common mistake of assessment via the outer isolation, as its never where agent compromise occurs - first ask "what can the agent do without crossing the boundary?" Start there. If you don't have an answer to that, that's very likely where things will go wrong first.
nolabs.ai/blog/sandbox-primeโฆ
4
8
410
Luke Hinds retweeted
Streaming tomorrow: Agent Sandboxing with "nono". Co-founder @decodebytes joins me as we dig into how it works, how to restrict single commands, agent harnesses, tool calls, and egress filtering URLs, e.g. blocking GitHub write access. Click "Notify me" on YouTube to ping you when we go live
#devsecops #agenticdevops piped.video/live/qZ2AOZjSm9g
1
2
683