AI agents don't just answer questions any more. They write code, run it, call tools, and spin up sub-agents to do the work. Every one of those hand-offs is a new place for things to go wrong: a leaked credential, a poisoned dependency, or a sub-agent that reads far more than it should. On 2 November I'm joining Amazon Web Services (AWS) for a webinar: Secure AI Agents on Amazon EKS: Sandboxing Sub-Agents with nono. We'll show how to layer two levels of defense: → Amazon EKS isolation around the workload → nono's kernel-enforced agent runtime protections around every agent and tool inside it No root, no code rewrites, nothing for the agent to talk its way around. If you're running agents on Kubernetes, or about to, come along. Registration link in the reply 👇 #AIAgents #Kubernetes #AmazonEKS #AppSec #OpenSource

Fan boy moment, meeting YAML creator Ingy at #OpenSourceSummit and finding out they were one of our first cohort of nono.sh users

Something we have been experimenting with using nono's remote capable multiplexer

Running a headless pi agent from 10,000 feet, started remotely with a full TUI from my terminal in London, to then connect via our web portal to check on progress during flight to then use my terminal again later to connect in Amsterdam , fully secured in Nono.sh - no more walking around with a lid open. Pm me to learn more or find me at #AGNTCon

A host of new agent harness support on nono.sh rolled out over the past few days: - @anacondainc kilo: registry.nono.sh/packages/no… - @deepseek_ai Deep Code: registry.nono.sh/packages/no… - @cast_ai kimchi: registry.nono.sh/packages/no… - @_can1357 oh-my-pi: registry.nono.sh/packages/no… - @MistralAI mistral vibe: registry.nono.sh/packages/no…

If you drop down the YouTube speed of Sarniezz to 0.85 it sounds like Dub Reggae piped.video/watch?v=t7OIc-DB…

Our AI PR reviewer expired and everything was really expensive and meant we were giving out data to someone else.....so.... @nolabshq no'sters took the challenge to build their own 𝘀𝘂𝗽𝗲𝗿 𝗱𝘂𝗽𝗲𝗿, 𝘀𝗲𝗰𝘂𝗿𝗲 AI reviewer! This thing is basically saying '𝘺𝘰, 𝘧𝘰𝘳𝘬 𝘢𝘵𝘵𝘢𝘤𝘬 𝘱𝘳𝘰𝘮𝘱𝘵 𝘪𝘯𝘫𝘦𝘤𝘵𝘪𝘰𝘯, 𝘤𝘰𝘮𝘦 𝘢𝘵 𝘮𝘦 𝘣𝘳𝘰!' and its built with special sauce from the OG itself - nono.sh ! Introducing 𝗻𝗼𝗴𝗲𝗻𝘁 (yes, I still suck at names!) Here is what nogent brings to a linguistic instruction fight! • 𝗖𝗮𝗻𝗮𝗿𝘆-𝗴𝗮𝘁𝗲𝗱 𝗼𝘂𝘁𝗽𝘂𝘁: the model must echo a per-run random canary inside a bounded JSON structure; any response that omits/alters the canary or violates the required shape is discarded and replaced by a "manual review needed" comment. This limits the effect of prompt injection on posted output. • 𝗕𝗼𝘂𝗻𝗱𝗲𝗱 𝗱𝗶𝗳𝗳𝘀 (maxFiles/maxPatchBytes) and fail-secure. • 𝗻𝗼𝗻𝗼 𝗯𝗼𝘂𝗻𝗱𝗮𝗿𝘆: fork-controlled tarballs, diffs, prompts, and model tool calls are processed in a separate nono-sandboxed process. The trusted listener keeps the App private key and webhook secret. • 𝗣𝗵𝗮𝗻𝘁𝗼𝗺 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀: nono's credential proxy keeps the real repository-scoped GitHub token and API keys out of the workers sandbox. The child receives one random 256-bit session token that is valid only at its loopback proxy. • 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁-𝗹𝗶𝗺𝗶𝘁𝗲𝗱 𝗲𝗴𝗿𝗲𝘀𝘀: the worker can call only the GitHub read/comment endpoints required for its target repository, generation, and GitHub's tarball host. It has no filesystem write capability or working directory access. • 𝗕𝘂𝗶𝗹𝘁 𝘄𝗶𝘁𝗵 @chainguard_dev 's distroless glibc-dynamic , no shell, no package manager, no busybox in the runtime layer. • 𝗧𝗟𝗦 𝘃𝗶𝗮 𝗿𝘂𝘀𝘁𝗹𝘀 + 𝗿𝗶𝗻𝗴, 𝘄𝗶𝘁𝗵 𝗠𝗼𝘇𝗶𝗹𝗹𝗮 𝗿𝗼𝗼𝘁𝘀 𝗯𝗮𝗸𝗲𝗱 into the binary (webpki-roots); no host CA trust, no OpenSSL in the runtime. • Signed 𝘄𝗶𝘁𝗵 @projectsigstore 𝗰𝗼𝘀𝗶𝗴𝗻 (keyless, OIDC), with SBOM and SLSA-provenance attestations published alongside each tagged release Quite soon we are going to mate it with runseal and make supply chain attackers cry into their oxtail soup github.com/nolabs-ai/nogent and runseal its elder sibling, both offspring of nono.sh github.com/marketplace/actio…

That's awesome, will this have an SDK? We built a detachable PTY proxy into nono.sh. A supervisor process owns the PTY master, while a sandboxed child uses the slave for stdin, stdout, and stderr. A client attaches over a Unix socket, which carries raw terminal bytes bidirectionally. We have external bridge that can expose that stream remotely over WebSocket, translating resize and detach controls as needed. Here is it with ghostty (which btw was the cleanest to work with (kitty / wezterm was a PIA)). Looking forward to having a play sometime.

Dissecting the incredibly dumb category of 'agent sandbox' A stack where everyone makes the wrong assumption when assessing a sandbox - don't make the common mistake of assessment via the outer isolation, as its never where agent compromise occurs - first ask "what can the agent do without crossing the boundary?" Start there. If you don't have an answer to that, that's very likely where things will go wrong first. nolabs.ai/blog/sandbox-prime…

We just shipped ephemeral micro sandboxed tool execution! A collaborative effort along side smart folks from Datadog and Okta - the first of its kind, you can set a policy for an individual CLI tool execution - demonstration in the link.. piped.video/watch?v=ndTM1DoG…

The claude code nono package just passed 50,000 pulls directly into a zero latency sandbox - it is already about to head past 60k. Copied by many, yet rivalled by few - nono pioneered the zero-latency, zero-setup agent sandbox, and continues to innovate and lead the way.

I give up with @ycombinator news - seems so petty to let users just flag you without reason.

Containers share the host kernel by design. For AI agents executing model-generated code, that's a real problem - one kernel exploit reaches the host. New post on Kubefence from @pradipta_kr from @RedHat : stacking Kata Containers + Seccomp + nono into one RuntimeClass. 👇 nono.sh/blog/kubefence-multi…

Seriously, what is happening at @github - cannot do any work and seriously considering alternatives now.

This week in nono.sh #nono #hermes agent

A lot of frustrated #NemoClaw , OpenShell users turning up in the nono.sh community, checked it out - kind makes sense. Around 4 docker images, a k8s cluster, to run a coding agent.

Project Nono - Monthly Roundup 🎬 Here's what shipped over the last 30 days, in 60 seconds. A few highlights worth calling out: Secure SKILL / Agent Artifact Registry (early preview) — sigstore provenance and prompt injection checks built in. Custom SKILLS / Profiles - built for teams that agent supply-chain security from day one, not bolted on later. Inbuilt Helper - no more wrangling pesky JSON. Let Nono steer the model for you.

Exciting new feature coming online shortly. nono.sh package and policy registry. we heard from users and they wanted a way of having a more customized self-serving system for having nono configure agent hooks, skills and nono policy.

A very bizarre experience of meeting my first claw in the wild. The Day of the Claws: How I watched an agent reverse-engineer my career in an afternoon. decodebytes.substack.com/p/t…

It is time for me to reveal the truth - I am Satoshi Nakamoto I just don't have any proof. nono.sh/blog/secure-agent-au…

Took nono.sh to the @aiDotEngineer event in London this week. Wasn't expecting to spend half the day being stopped by engineers telling us they're daily users. One team even demoed nono integrated into their own product - live, in the wild, built by someone we'd never met. Big thanks to everyone who came and said hello.

demo of multiplexing sandboxes in nono and how its used in multi agent worktasking piped.video/watch?v=QqRt4tKR…

Anthropic just detailed the engineering behind "Auto Mode" for Claude Code, and it exposes an emerging an unaddressed dichotomy in AI agent security. The problem? Developers now suffer from "approval fatigue" where AI agents constantly ask for permission to run code. The human solution? Blindly clicking "Approve" 93% of the time, or disabling its sandbox entirely with --dangerously-skip-permissions. Anthropic’s fix is a two-stage AI classifier that auto-approves what are deemed "safe actions" and blocks dangerous ones. Sounds great, but in their favour they are honest about the results.. It has a 17% False Negative Rate. That means roughly 1 in 6 genuinely dangerous or overeager actions still slips through. The rationale from Anthropic - is that since developers have almost 100% checked out and don't care about what the model is producing, the 17% failure rate is enough of a benefit to release this as GA software.

tmux style sandboxes anyone? along with full docker-eque style lifecycle and atomic rollbacks? nono.sh

nono.sh/blog/openclaw-nono-c… Had a lot of folks asking the difference between nono and @nvidia 's OpenShell shipped in Nemoclaw this week - as both had a significant shared feature surface and terminology - so I wrote an unbiased as possible teardown and it turns out they have quite different architectural differences and applications of use.

nono.sh 's python library protecting @pydanti_ai / @FastAPI based agents with kernel enforced sandboxing

Spent an hour with @WeAreDevelopers breaking down why agent security has to live at the kernel, not the app layer. Watch it here: piped.video/watch?v=xVK29ANv…

alan watts touched upon this, tax the machines piped.video/watch?v=OhvoInEs…

Go bindings for nono.sh from kipz - get native sandboxing in your go apps: github.com/kipz/nono-go

little nono.sh is just 30 days old, just about to hit a 1k 🌟's - Its fairing very well against the OSS security giants - lets see if it can keep up the 🚀 trajectory

Nerd fanboy alert: when someone you looked up to as a cryptography wizard / engineer makes a PR to your project along with a compliment - thanks @jedisct1 !

Containers and microVMs solved a well-defined problem: process isolation between workload and host. They are best in class for host/guest isolation, resource constraint and environment isolation. Industry transformative and nothing less. The mistake is assuming the same specialism solves the new problems that agents present. An agent is not a workload to isolate, it's far more nuanced. It is an autonomous decision-making system operating , sometimes on your behalf, at runtime, against often sensitive material, in ways that cannot be fully anticipated at launch time. Placing it in an isolated environment and considering the security problem solved because the host is protected and the guest is isolated is not enough. The agent needs access to sensitive resources to do its job, and those resources require protection as well. When the agent needs capabilities beyond its initial grant, it requires a secure, mediated channel to request them. Without one, privilege elevation becomes a path that bypasses the very isolation boundary you depended on. Existing primitives enforce boundaries. They do not enforce intent, auditability, or runtime access control over an actor whose behaviour is non-deterministic by design. Nono is built on a different premise: the sandboxed process is untrusted by construction, and capabilities are granted dynamically under explicit oversight, enforced at the kernel level, and recorded with immutably. The supervisor is the mechanism that realises this, and its nono's superpower. The supervisor runs outside the sandbox, intercepts every file access syscall via seccomp-notify, and mediates every access decision before it reaches its entity. The agent never executes its own calls. Privilege elevation requests are trapped, approved over a secure verified channel, and fulfilled via direct file descriptor injection. The audit trail and access gate - is not an instrumentation on top of execution. It is direct in the execution path. API credentials never enter the agent's address space. Files can be cryptographically attested, right back to the source code - before the agent even reads or executes them. And the best bit of all, already have a container orchestration system in place, well nono runs quite at home in either a container or a microVM - belt, braces, and a safety harness. This is not a tightening of existing primitives or a repurposing of previous tools. It is an approach purpose-built for a new era. nono.sh #AgenticAI #Security

Its always nice to get a bit of love and appreciation as an OSS maintainer

Reminds of the opening scene from Uptopia (the better one) piped.video/watch?v=rcx-nf3k…

Not even two weeks since releasing nono.sh - and we jumped to the top of GitHub Trending, inboxes blew up, and long established solutions quickly put out competitive battlecards and posts (taken as a real compliment) - but to top it all, seeing an excited community emerge and come together to rally around the project to solve a pain point with a pragmatic solution built for the current paradigm of how agents are operating I checked out a comparison point with previous open source security projects I've been involved in, and it's clear something exciting is in the making - the little blue line is just one week. #AgenticAI #Security

We are configuring autonomous systems with prose. SKILLS.md, RULES.md, CLAUDE.md - loaded into the same context window as untrusted data. The model has no way to separate its own instructions from an attacker's. The control plane and data plane we built out as seperate, the lessons we learned about xss attacks, sql injections - and here we are , back where we started again. A post I wrote about why I built nono: alwaysfurther.ai/blog/why-i-… #AIAgents #InfoSec #OpenSource #PromptInjection

"trust-based guidelines" decisions deferred to Agents are just an accident waiting to happen. don't yolo, nono.sh

nono.sh part two: nono --net-block bash <(curl url): curl d'loads script outside the sandbox, bash executes it inside with network blocked. The malicious script can't exfiltrate / cause any damage - the kernel denies .ssh write with "Operation not permitted."

Not bad company to be in

cool things you can do with nono.sh - part one: nono'ception - aka nono spawns itself into a nono sandbox and then asks nono, why can I not access ~/.ssh/id_rsa

Software Supply Chain Security in the Age of AI Agents alwaysfurther.ai/blog/sigsto…

DeepFabric now supports live tool execution during dataset generation, isolated within web-assembly components care of the @spinframework - this produces training dataset with far less hallucinations and encourages more reactive learning patterns.