nitrocode

SysConf 2026 · Sat 3 Oct · 12:25–12:55 WAT · Room 1 · Standard 30m

SysConf 2026 · Standard

How to Safely Give AI Agents a Terminal

Alex Idowu · Co-founder & CTO, PipeOps · Lagos

Sat 3 Oct 2026 · 12:25–12:55 WAT · Room 1
25 min talk + 5 min Q&A · live Rexec sandbox demo

Field notes: blog post · Rexec

Present · P or button · Navigate → ← · Esc exits · Deep link ?present=1

01 · Title

How to Safely Give AI Agents a Terminal

Alex Idowu · PipeOps · Lagos

SysConf 2026 · Room 1

02 · Claim

AI agents need a terminal to be useful.
Giving them yours is a bad idea.

Isolation problem. Not a prompt problem.

Rexec is one shape. Jobs + RuntimeClass works too.

03 · Scene

Laptop. Dev VM. Shared CI runner.
Sometimes worse.

curl | bash secrets in the environment kubeconfig in ~/.kube

You’re not doing chat. You’re doing untrusted RCE with a friendly UI.

04 · Wrong default

The wrong default

  1. Install the agent CLI on a machine you care about
  2. Point it at a repo
  3. Grant shell / network / package install
  4. Hope system prompts and “approve tool use” are enough

Hope is not a control.

05 · Without malice

Even without malice

Secrets on diskWorld-readable files
Creative rmPath expansion surprises
ExfilHTTPS or DNS
Phone homePackages + thrash

Blast radius = the machine you care about.

06 · Contrast

Human terminal vs agent terminal

HumanAgent
IntentUsually intentionalExploratory, error-prone
SpeedSeconds between commandsBursts of tool calls
OversightEyes on the glassOften headless
NetworkExpects outboundWill try outbound
LifecycleHours to daysMinutes, then delete

07 · Reframe

Treat it as isolation

Not a prompt problem.

Sandbox = create / delete + quotas + network policy + audit.
Not a system prompt.

“Approve tool use” on a machine you care about is still RCE with a dialog.

08 · Requirements

What “sandbox the agent” has to mean

  1. Disposable by default
  2. Hard CPU / memory / PIDs
  3. Network isolation as a first-class switch
  4. API / headless entry
  5. Audit when it matters
  6. Outbound tunnels for real metal — not open 22

09 · Architecture

Two primitives

Agent / CLI / UI │ API or WebSocket ▼ Control plane — create / exec / delete │ ├── Cloud terminal (container + gVisor + limits + isolated net) └── BYOS agent (outbound WebSocket → real hardware)

Strong isolation ≠ strong access to weird iron. Don’t confuse them.

10 · Cloud terminal

Cloud terminal

  • Docker / Podman with hard limits
  • Cap drop + no-new-privileges
  • Isolated bridge, ICC off
  • OCI runtime runsc (gVisor)
  • Attach via API / WebSocket — not published SSH

That model is what I designed into Rexec. Steal the shape.

11 · Demo · Rexec

Live: disposable sandbox

  1. Create a sandbox (limits + network mode)
  2. Show the isolation you asked for (egress / peer)
  3. Run something agent-shaped
  4. Delete. Assume disk is gone.
# shape, not scripture — use your real Rexec flow rexec sandbox create --network none # …attempt / show block… rexec sandbox delete

If AV fights you: screenshots. Don’t fight conference wifi.

12 · Ladder

Isolation ladder

  1. cgroup + caps + network — baseline
  2. gVisor (runsc) — smaller host syscall surface
  3. MicroVMs (Firecracker) — when the threat model demands it
  4. Dedicated nodes / accounts — compliance, not cosplay

Containers alone aren’t a hostile multi-tenant boundary. Name the rung you’re buying.

13 · Network

Network is the product

A cloud terminal is a network endpoint that happens to have a shell.

T1Peer to peer
T2Host / metadata
T3Egress exfil
T4Published ports
T5Confused deputy

Egress: none · allowlist · full (you accepted the leak).

ICC off ≠ no internet. Say it out loud.

14 · Flow

Agent flow

1 · CreateImage + class + network
2 · SecretsShort-lived only
3 · RunHeadless by default
4 · AttachHuman if needed
5 · DeleteDisk + memory gone

15 · BYOS

BYOS: mediated access, not a jail

Outbound WebSocket. No inbound SSH for the demo.

NeedPrefer
Untrusted model codeCloud terminal + gVisor
Real GPU / lab boxBYOS — treat like prod access
Shared expensive machineBYOS + identity + recording

16 · Failures

Failure modes I’ve hit

  • Docker socket — relocates the gate
  • Open egress — agents phone home
  • Thrash — quotas / TTLs are security features
  • Prompt as security — UX, not a boundary
  • Runtime theater — gVisor on paper, runc in prod

17 · Checklist

Field checklist

  1. Ban agent shell on laptops for secrets / prod
  2. Create / delete per task (or per PR)
  3. Run agent sandboxes on gVisor or stronger
  4. Set egress deliberately; treat DNS as data
  5. Cap CPU / memory / PIDs; kill on a timer
  6. Prefer outbound agents over inbound SSH
  7. Assume breakout; escalate when the threat model says so

18 · Takeaways

Takeaways

  1. Agents are remote code execution with better UX
  2. Sandbox = create/delete + quotas + network + audit
  3. Containers alone ≠ hostile multi-tenant boundary
  4. Prefer outbound tunnels over inbound SSH
  5. TTL and concurrency caps are security features

19 · Close

Questions?

/blog/2026/08/11/how-to-safely-give-ai-agents-a-terminal /talks/sysconf-2026 github.com/PipeOpsHQ/Rexec

Alex Idowu · @nitrocode · Lagos