{"id":2159,"date":"2026-10-11T20:20:45","date_gmt":"2026-10-11T14:50:45","guid":{"rendered":"https:\/\/judepereira.com\/blog\/?p=2159"},"modified":"2026-10-11T21:26:06","modified_gmt":"2026-10-11T15:56:06","slug":"building-jupiter-security-sandboxing-ideas","status":"publish","type":"post","link":"https:\/\/judepereira.com\/blog\/building-jupiter-security-sandboxing-ideas\/","title":{"rendered":"Building Jupiter: Security Sandboxing Ideas"},"content":{"rendered":"\n

This post follows Why I Decided To Build My Own Agentic IDE<\/em><\/a>, and is a part of the series Building Jupiter<\/a>.<\/em>
<\/p><\/blockquote><\/figure>\n\n\n\n

There are numerous techniques that a rogue AI agent may employ to access to something that it shouldn\u2019t.<\/p>\n\n\n\n

Let\u2019s talk about some of these:<\/p>\n\n\n\n

    \n
  1. Credentials such as your cloud deployment key, or your private SSH key that permits passwordless access to your production workloads<\/li>\n\n\n\n
  2. Unrestricted network access that lets an agent communicate with the outside world, potentially even shipping some of your confidential data (proprietary algorithms for example) to a message board to ask for advice<\/li>\n\n\n\n
  3. Unfettered access to temporary access tokens generated on your behalf for MCPs and CLI access (accessible from Claude or Codex\u2019s database stored on your MacBook or Linux server)<\/li>\n<\/ol>\n\n\n\n

    These naturally pose a threat that could very well be exploited by a capable agent.<\/p>\n\n\n\n

    Incident: A Rogue Agent in Jupiter<\/h2>\n\n\n\n

    During the early days of Jupiter, its MCP integration was laughable, where it didn\u2019t understand nested data structures and arrays. As a result, when an agent tried to use the GitHub MCP to list PRs, the MCP call would fail repeatedly. Out of desperation, it resorted to enumerating the values in its environment, found a GitHub private authentication token (PAT), and issued a curl command to GitHub\u2019s API. Granted, it did accomplish what it set out to do, but this wasn\u2019t the intended method. <\/p>\n\n\n\n

    PS – Jupiter tackles this issue smartly. Continue reading below :)<\/p>\n\n\n\n

    The Guardrails Fallacy<\/h2>\n\n\n\n

    Whenever I talk about this problem to colleagues or friends, their common response is, \u201cwell, let\u2019s add some guardrails – tell the agent what it can and cannot do\u201d. Are you serious? No amount of prompting security measures is going to let me sleep peacefully at night. Guardrails, simply put, are \u201csoft limits\u201d. Imagine a human child – you tell them to wait for ten minutes until their chocolate lava cake cools down, so that they don\u2019t burn their tongue. What\u2019s the probability that they\u2019d follow through, especially if this is their first ever chocolate lava cake?<\/p>\n\n\n\n

    The Network Layer<\/h2>\n\n\n\n

    An agent must only be granted that what it needs in order to accomplish its task. <\/p>\n\n\n\n

    <\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Let\u2019s talk about the network:<\/p>\n\n\n\n

      \n
    1. Whitelist trusted domains that are essential to do its work, such as GitHub.com, and software package vendors (Maven Central, NPM). Start with a complete lockdown, and then discover step by step which domains are required. <\/li>\n\n\n\n
    2. Restrict access to the agent control plane itself. Frequently, as is the case with Jupiter too, the control plane itself can reveal sensitive data such as API keys. Password protecting this ensures that a rogue agent cannot use its own control plane to gain unfettered access. <\/li>\n<\/ol>\n\n\n\n

      The Execution Environment<\/h2>\n\n\n\n

      Next, let\u2019s take a look into the operating environment of an agent. With many users running Claude or Codex with unrestricted command execution, the agent is free to inspect its environment, modify frequently used commands, along with shell initialisation scripts. What can you do?<\/p>\n\n\n\n

        \n
      1. Run your agent in a container, or a VM<\/li>\n\n\n\n
      2. Encrypt its harness’ database, but please don\u2019t leak the encryption key as an environment variable<\/li>\n\n\n\n
      3. Protect environment variables (a clever approach is to pipe the entire env from one user into another user, in order to prevent making them available under \/proc) – Linux\u2019s user safety mechanisms won\u2019t let one user access another user\u2019s process environment<\/li>\n<\/ol>\n\n\n\n

        Putting It Together<\/h2>\n\n\n\n

        <\/p>\n\n\n\n

        \"\"<\/figure>\n\n\n\n

        I\u2019ve tried to tackle all of these potential attack vectors while building Jupiter:<\/p>\n\n\n\n

          \n
        1. Encrypted database, ensuring that the key cannot be leaked to a rogue agent<\/li>\n\n\n\n
        2. A network sandbox – my current implementation is whitelisting domains and permitting IPv4 access on demand, based on DNS resolutions (dnsmasq + nftables). This, however, lives in a Docker compose setup – judepereira\/oc-sandbox<\/a>, but will be ported over to Jupiter natively soon :)<\/li>\n\n\n\n
        3. Environment variables are piped in through stdin, and are stripped from the environment before forking Jupiter itself<\/li>\n<\/ol>\n\n\n\n

          Closing Thoughts<\/h2>\n\n\n\n

          AI agents are incredibly powerful. Before you run them in dangerous modes, consider potential attack vectors carefully, and do what you need to do to sleep peacefully at night (or be an owl, that\u2019s up to you). <\/p>\n\n\n\n

          I cannot stress this enough, but understand what you do, and why. <\/p>\n\n\n\n

          Don\u2019t be a sheep, be a shepherd.<\/p>\n","protected":false},"excerpt":{"rendered":"

          A few ideas about security sandboxing your AI agents, so that you don’t wake up to a rogue agent one fine day.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[744,732,722],"tags":[735,709,740,672,737,739,546,726,736,733,734,741,252,738],"class_list":["post-2159","post","type-post","status-publish","format-standard","hentry","category-building-jupiter","category-jupiter","category-virtual-engineering","tag-agent","tag-ai","tag-claude","tag-cli","tag-cloud-agents","tag-codex","tag-coding","tag-cursor","tag-harness","tag-jupiter","tag-opencode","tag-rogue","tag-security","tag-self-hosted"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t