500 Packages Backdoored, 732 Bytes to Root Every Linux Box: Agent Security Isn't About How Hard Your Sandbox Is—It's About Who Governs After Isolation

“Give your agent its own computer” might have been the most repeated phrase in AI infrastructure in early 2026. Satya Nadella said it. LangChain shipped LangSmith Sandboxes. Anthropic published two deep-dives on Claude’s containment architecture.

The direction is right. But most of the discussion converges on a single point: how to let agents run code safely inside a sandbox. As if a hard enough sandbox — gVisor not enough? microVM. microVM not enough? hardware isolation — solves the problem.

If you’ve actually run an agent cluster in production, you know: sandboxes solve “will this agent blow up my infrastructure.” They don’t solve “15 agents are running in 15 sandboxes simultaneously — who coordinates their lifecycle,” “how does Agent A’s execution result get passed to Agent B,” or “Agent wrote a file — does that write need approval, and from whom.”

Sandboxing is the first layer of security. It is far from the last. The real problem in agent security isn’t isolation depth — it’s what happens to the system after isolation.

Who should read this? Engineers and architects moving agents from demo to production — especially those who’ve deployed sandboxes, microVMs, and hardware isolation, only to find the system still lacks observability and governance. If you’re wrestling with where agent security boundaries actually end but suspect sandboxing alone isn’t enough, this is for you.

By the end, you should be able to answer three questions:

1. Why aren't containers an isolation boundary for agent code execution—how does 732 bytes penetrate them, and why isn't hardware virtualization enough on its own?
2. Sandboxes solve secure agent execution but not sandbox orchestration—in multi-agent scenarios, who manages sandbox creation, destruction, and state transfer?
3. How do BeeOS's three protocol entries turn agent code execution from "isolate one point" into "govern an entire chain"?

Zero: The Facts — What LangSmith Sandboxes Actually Did

In September 2025, an npm worm called Shai-Hulud backdoored 500+ packages. Code executed at the preinstall stage — before any human review. In November, a second wave hit 796 packages and 25,000+ GitHub repositories, spreading within hours.

Six months later, a vulnerability called Copy Fail (CVE-2026–31431) was discovered — a 732-byte Python script that exploited a Linux kernel crypto API flaw to root every major Linux distribution going back to 2017. AI tooling found it in roughly an hour.

These are the two numbers LangChain’s team opens with in “Give your agent its own computer.” Their thesis: containers are not an isolation boundary. For untrusted, model-generated code, you need hardware-level separation.

LangSmith Sandboxes’ approach: — Hardware-virtualized microVMs (not containers; each agent gets its own kernel) — Snapshots / Forks (copy-on-write; ten parallel branches cost roughly the same as one) — Blueprints (pre-warmed environment images, second-level startup) — Service URLs (agent starts a local web server → auto-generated URL, no port forwarding) — Auth proxy (credentials never enter agent runtime; injected at network layer)

monday.com is already using this in production to power their Sidekick AI assistant’s code execution capabilities.

Facts sourced from LangChain Blog (Give your agent its own computer, Amy Ru, 2026–06–05). Real-world performance varies by deployment environment.

One: Why Containers Aren’t Enough — The 732-Byte Lesson

Before explaining how BeeOS addresses sandbox governance, we need to settle one thing: why containers aren’t enough.

Engineer intuition says “Docker isolates well enough.” That intuition is correct for traditional application deployment — you’re running known, vetted application code. Web servers, background jobs, databases — you know what this code does. You trust it the way you trust your coworker not to install a backdoor on your desk.

Agent scenarios are completely different. The code an agent executes can come from: — Model-generated code — completely unpredictable, with zero chance of prior review — Instructions embedded in user prompts — possibly malicious, possibly careless, definitely unreviewed — git clone repositories—READMEs can hide malicious code, .npmrc can point to a poisoned registry - npm install / pip install third-party packages—supply chain attacks quadrupled year-over-year in 2025, not because you’re unlucky, but because attackers discovered agents are the ideal propagation vector

Shai-Hulud’s infection path is an exact demonstration: an agent runs npm install to complete a task like “install a package to analyze data.” The package’s preinstall script executes malicious code directly—the agent hasn’t even started using the package yet, and infection is complete. Attackers don’t need the agent to call a “malicious function”—preinstall is enough.

Copy Fail exposes something deeper: containers share a kernel with the host. Any kernel-level vulnerability — even 732 bytes — can penetrate the container boundary. AI tools found it in an hour, meaning attackers could weaponize it in the same timeframe. This is the critical judgment in the LangChain article: “A container boundary is not an isolation boundary.”

So microVMs are correct. Hardware virtualization is correct. One computer per agent is correct. LangSmith Sandboxes made the right infrastructure-level decisions — from microVMs to copy-on-write forks to Auth proxy.

But the problem starts here, not ends here. Because sandboxes only define “how far an agent can blow things up,” not “what an agent can blow up.” The latter isn’t about hardware isolation — it’s about governance.

Two: After the Sandbox — Three Ignored Governance Problems

Once you’ve given 15 agents each their own microVM sandbox, three problems hit you quickly. They’re not security problems — they’re governance problems.

Problem One: Who Owns Sandbox Lifecycle?

LangSmith Sandboxes are created with a single line: client.create_sandbox(). After the agent finishes executing, the sandbox “disappears.”

But this simple lifecycle gets complicated fast in real scenarios:

• One task requires three agents collaborating — each opens its own sandbox, or share one? If shared, can Agent A’s dependency conflicts affect Agent B? If separate, who’s responsible for creating, destroying, and tracking costs across three sandboxes?
• Agent A spent 8 minutes installing Python dependencies, configuring database connections, and cloning repos inside its sandbox. Agent B’s sandbox needs the same environment — does Agent B spend another 8 minutes reinstalling, or fork from Agent A’s snapshot? If forking, does Agent A’s temporary data get carried over?
• Intermediate results — a 2GB CSV Agent spent two hours generating — should they be visible only to the creator, or shareable with other agents? If shareable, through what channel — a file link or a direct copy to the target sandbox?
• If a sandbox executes a write operation — modifying a shared config file, writing a record to a shared database — does this modification need approval? Whose approval? Can the agent judge for itself?

LangSmith Sandboxes solve “give each agent a computer.” They build each “computer” well. They don’t solve “how these computers coordinate, and who manages their lifecycle cradle-to-grave.”

This isn’t LangSmith’s fault — its positioning is the execution layer. Stuffing orchestration into execution, versus exposing execution to orchestration, are fundamentally different architectural tradeoffs.

Problem Two: How Do Agents Pass Sandbox Results Between Each Other?

Here’s a scenario — it’s not hypothetical, it’s what any team building a data analysis pipeline encounters:

1. DataCollector Agent runs Python in Sandbox A, pulls data from three sources, cleans, deduplicates, saves a CSV
2. DataAnalyzer Agent needs that CSV for statistical analysis, outputs a JSON report
3. ReportWriter Agent needs the analysis results to generate a PDF report with charts

If this pipeline runs on LangSmith Sandboxes, you need to solve “how does Sandbox A’s result reach Sandbox B” yourself. LangSmith provides Snapshots/Forks — but Fork captures the entire sandbox disk state, not “just pass the CSV to the next agent.”

Using Fork/Snapshot to pass intermediate results is like sending your coworker an entire hard drive image just so they can look at one Excel file. You’re not just wasting resources — you’re creating security exposure: Agent B, receiving Agent A’s full sandbox state, can see everything A did in that sandbox. If A’s sandbox has sensitive data (temporarily cached database credentials, real user data used for testing), B now has access to all of it.

This problem appears to be about “how to transfer a file.” It’s actually asking: do agent-to-agent task transfers have defined input/output boundaries? If every transfer is “here’s my entire workspace, find what you need yourself,” that’s not collaboration — that’s mutually trusting streaking.

Problem Three: Where Are the Permission Boundaries for Write Operations?

When an agent executes code inside a sandbox, what it does falls into three categories: — Writes files — normal; sandboxes are for this. Generating CSVs, JSON, images, logs inside the sandbox is fine. — Calls external APIs — through Auth proxy, credentials are secured. The agent never sees the API key. — Modifies shared state — updating a database order status, changing a user’s permission config, uploading a payroll CSV to the HR system.

The first two are security problems LangChain’s Auth proxy and microVM isolation solve well. The third is a permission problem, fundamentally different from security:

Security asks “can the agent touch this system.” Permission asks “once the agent touches it, what level of operation can it perform.”

In LangChain’s model, what an agent can do depends on which tool access it’s been granted. But tool authorization is typically binary — either you can call this API or you can’t. There’s no middle ground of “can call, but write operations need approval.”

And in production: agent code execution results frequently involve write operations. Rippling’s Action Agent needs to upload bonus CSVs, normalize job titles, trigger onboarding workflows. Lyft’s customer support agent needs to refund, modify orders, issue coupons. Behind every write operation is a judgment: “Can the agent decide this on its own, or does a human need to sign off? If a human needs to, is it real-time approval or post-hoc spot check?”

Sandboxes protect your infrastructure from being blown up by an agent — microVM isolation guarantees that malicious code execution won’t give the agent your host machine’s root access. But sandboxes don’t protect your business data from being mistakenly modified by an agent. An agent can perfectly legally, inside a sandbox, through an Auth proxy, call a legitimate API with legitimate credentials, and modify a field it shouldn’t touch — the sandbox is completely oblivious.

That last problem doesn’t need deeper isolation. It needs finer permission governance.

Three: BeeOS’s Approach — Split Sandbox Governance Into Three Protocol Lines

These three problems — lifecycle management, inter-agent result passing, write operation approval — share a common trait: sandboxes can’t solve them.

Sandboxes solve “isolation.” These three problems each need: — Lifecycle → control plane (create/destroy/snapshot/health check) — Result passing → collaboration plane (task input/output schema + state streaming) — Write approval → access plane (tool call permission boundaries)

BeeOS didn’t build a better sandbox. What it did: split sandbox governance into three dimensions, each handled by one protocol entry.

OpenAPI Control Plane: Sandbox Lifecycle Lives Here

In BeeOS, every agent instance is deployed through OpenAPI. Instance lifecycle — deploy / invoke / terminate — is uniformly managed by the control plane.

For agent sandboxes, this means:

import { InstancesApi } from "@beeos-ai/sdk";

const api = new InstancesApi(config);

// Create a sandbox instance for CodeRunner Agent
const sandbox = await api.deployInstance({
  name: "code-runner-sandbox-1",
  kind: "sandbox-microvm",
  isolation: "hardware",  // microVM isolation level
  resources: { cpu: 2, memory: "4Gi", disk: "20Gi" },
  labels: { agent: "CodeRunner", task: "data-analysis" },
});

// Control plane actively terminates sandbox after agent completes
await api.terminateInstance(sandbox.id);

// Check sandbox status anytime
const status = await api.getInstance(sandbox.id);

Each sandbox is an independent instance with a name, labels, resource config, and lifecycle. The SandboxOrchestrator Agent manages all sandbox creation/destruction/snapshots/health checks through OpenAPI.

Two things happen simultaneously: 1. Agents no longer open their own sandboxes. An agent requests a sandbox from SandboxOrchestrator; the orchestrator decides whether to grant one, how big, which blueprint to fork from. Agent code execution permissions and sandbox management permissions are separated. 2. Sandboxes are observable. Every sandbox instance has a complete lifecycle log in OpenAPI: when it was created, when destroyed, who created it, how long it ran, how many resources it used. When something goes wrong, you can trace.

A2A Collaboration Plane: Structured Boundaries for Inter-Sandbox Result Passing

When CodeRunner Agent finishes executing code in Sandbox A and produces a CSV, it needs to hand results to DataAnalyzer Agent. In LangChain’s approach, this handoff is a technical chore—you figure out how to move a file from Sandbox A to Sandbox B. In BeeOS’s A2A, this handoff is a protocol call.

import { A2AClient } from "@beeos-ai/sdk";

const a2a = new A2AClient(config);

// CodeRunner passes results to DataAnalyzer via A2A
const task = await a2a.sendTask({
  from: "CodeRunner",
  to: "DataAnalyzer",
  task: {
    type: "analyze_dataset",
    input: {
      dataset_url: "sandbox://code-runner-sandbox-1/output.csv",
      schema: ["timestamp", "value", "category"],
      row_count: 15000,
    },
    output: {
      expected: "analysis_report",
      format: "json",
    },
  },
  idempotencyKey: "task-cr-da-2026-06-07-001",
  timeoutMs: 300_000,
});

// DataAnalyzer streams progress back via A2A
for await (const event of task.stream()) {
  console.log(event.status, event.progress);
}

Here’s the key: every A2A task transfer has explicit input and output schemas.

CodeRunner doesn’t need to know where DataAnalyzer’s sandbox is, what dependencies are installed, or whether it has access—it only passes structured input. DataAnalyzer receives input in its own sandbox, runs code, produces output. Intermediate results are explicitly declared through input/output schemas—not through implicit shared-filesystem conventions.

Compare the two approaches:

Shared filesystem (no protocol):
  CodeRunner writes file to /shared/output.csv
  → DataAnalyzer looks for file at /shared/output.csv
  → Requires conventions: filename, path, format, "is it done writing?", "has it been read?"
  → DataAnalyzer can see everything else under /shared/ (including what it shouldn't)

A2A task transfer (with protocol):
  CodeRunner sends task { input: { dataset_url: "...", schema: [...], metadata: {...} } }
  → DataAnalyzer only receives what's in input
  → No conventions needed for filenames, paths, read/write state
  → DataAnalyzer sees nothing else from CodeRunner's sandbox

The latter extends “isolation between sandboxes” from infrastructure layer into collaboration layer: — Infrastructure isolation: microVM guarantees Agent A’s code can’t blow up Agent B’s sandbox — Collaboration isolation: A2A’s task input/output boundaries guarantee Agent A’s context doesn’t leak into Agent B’s context

MCP Access Plane: Precise Boundaries for Write Operation Approval

When an agent runs code in a sandbox, most operations are harmless — reading files, analyzing data, generating charts. But occasionally there are write operations — updating databases, calling external APIs to modify state, writing shared config.

LangChain’s Auth proxy solves “credentials don’t leak to agents.” It doesn’t solve “when an agent calls an API with credentials, does this call need approval.”

BeeOS’s MCP layer provides permission granularity. Not “can the agent call this API” — but “when the agent calls this API, which operations can it do on its own, and which need approval.”

Technically, this distinction is implemented on the MCP tools/call path:

// Permission configuration on MCP tools/call path
const mcpConfig = {
  tools: [
    {
      name: "read_from_db",
      permission: "bak_readonly",  // Read-only, no approval needed
    },
    {
      name: "update_order_status",
      permission: "bak_approval_required",  // Write operation, requires approval
      approver: "ApprovalGate",  // Approval Agent
    },
    {
      name: "upload_payroll_csv",
      permission: "bak_payroll_write",  // Payroll domain write permission
      approver: "PayrollApprovalGate",
      audit_enabled: true,  // Full audit logging
    },
  ],
};

The ApprovalGate Agent runs at the MCP layer, monitoring all tool calls marked bak_approval_required. When a write operation request arrives, ApprovalGate judges based on predefined approval rules: - Danger level low → auto-approve (e.g., updating log files) - Danger level medium → deferred approval, human spot-check within 24 hours (e.g., modifying config) - Danger level high → real-time block, mandatory human approval (e.g., uploading payroll CSV, batch-modifying order status)

ApprovalGate’s core value isn’t “what got blocked”—it’s “automate what can be automated, never let things requiring human judgment bypass humans.”

Binary authorization (can/can’t) has a problem: to make the system safe, you tend to tighten permissions — resulting in the agent needing human sign-off for everything, and approval fatigue hits you exactly like being stuck in Claude Code’s permission dialog loop. Anthropic’s data shows 93% of users blindly clicking “approve.” Permission granularity (read-only / write-needs-approval / high-risk-real-time-block) lets you concentrate approval resources where human judgment is actually needed.

These three layers aren’t independent — they cooperate in a complete workflow. Here’s the full chain of a CodeRunner from requesting a sandbox to completing execution to delivering results:

1. CodeRunner requests a sandbox from SandboxOrchestrator (OpenAPI)
2. SandboxOrchestrator forks a pre-warmed sandbox from Blueprint, ready in seconds
3. CodeRunner runs code in the sandbox—free to read/write files, external API calls go through MCP layer
4. Code complete, CodeRunner passes results (input: { dataset_url, schema }) to DataAnalyzer via A2A
5. DataAnalyzer receives input in its own sandbox, begins analysis
6. If analysis needs to write to database — ApprovalGate (MCP) determines approval level based on bak_ permissions
7. All agents complete, SandboxOrchestrator cleans up sandboxes, releases resources
8. **SandboxOrchestrator** | OpenAPI | Deploy / terminate / snapshot / health-check sandbox instances | bak_sandbox_admin: can manage sandboxes but cannot enter sandboxes
9. **CodeRunner** | A2A → MCP | Execute code in sandbox, produce results, pass downstream via A2A | bak_code_exec: can read/write sandbox files, cannot call external APIs
10. **DataAnalyzer** | A2A → MCP | Receive CodeRunner’s output, analyze in own sandbox | bak_analysis_read: can read data, cannot write
11. **ApprovalGate** | MCP | Intercept all bak_approval_required write operations, approve/block/escalate by danger level | bak_approval_enforce: read-only tools/call events, cannot directly operate on data
12. **TaskRouter** | A2A | Match task types to Agent Cards, route to correct downstream agent | bak_router_readonly: read-only Agent Cards, cannot modify

The core of the permissions table isn’t the role names — it’s that every row has a bak_ permission scope. The fundamental difference between CodeRunner and DataAnalyzer isn’t in their names; it’s in bak_code_exec vs bak_analysis_read. The former can write files but not call external APIs; the latter can only read data—permissions are precise down to “which operation, at which layer.”

Four: Closing

LangChain’s Sandboxes are precisely positioned: they solve the infrastructure problem of “give each agent a computer.” microVMs replacing containers, Snapshots/Forks engineered for production, Auth proxy credential separation — every design decision is correct.

But it only solves the first layer of security.

When you advance from “one agent runs code once” to “15 agents continuously collaborate across 15 sandboxes,” sandboxes alone aren’t enough. You need to answer three new questions: — Who is uniformly managing the creation and destruction of these sandboxes? — How do sandbox results pass between agents — shared filesystem or protocol? — For write operations inside sandboxes — which can auto-approve, which require human sign-off?

These three aren’t “security” problems — they’re “governance” problems. The biggest difference between security and governance: security is “prevent bad things from happening,” governance is “make good things happen in an orderly way.”

BeeOS didn’t reinvent the sandbox. What it did: above the sandbox — on OpenAPI’s control plane, A2A’s collaboration plane, MCP’s access plane — each got a governance layer.

1. In your agent cluster, who manages sandbox creation and destruction? Do agents open their own sandboxes, or is there an independent SandboxOrchestrator?
2. When two agents need to share sandbox execution results, do they pass structured input/output tasks, or through a shared file directory?
3. For write operations inside agent sandboxes—database updates, config modifications, file uploads—is there a bak_ permission table defining "which operations need whose approval"?

If these three questions don’t have answers yet, SandboxOrchestrator + A2A task boundaries + MCP bak_ approval chain would be a starting point that doesn’t require reinventing the wheel.

References & Further Reading

• Case source: Give your agent its own computer (LangChain Blog, Amy Ru, 2026–06–05)
• Related: How we contain Claude across products (Anthropic Engineering, 2026–05–25)
• Related: Scaling Managed Agents: Decoupling the brain from the hands (Anthropic Engineering, 2026–04–08)
• Copy Fail CVE-2026–31431 Analysis
• BeeOS: docs.beeos.ai · openapi.beeos.ai · a2a.beeos.ai · mcp.beeos.ai
• MCP Spec: modelcontextprotocol.io
• A2A Spec: github.com/google/A2A

BeeOS: docs.beeos.ai · openapi.beeos.ai · a2a.beeos.ai · mcp.beeos.ai