Code execution lets agents choose when to write and run code, which removes much of the hand-built orchestration around agent loops.
2
Sandboxing and restricted network access limit the damage from prompt injection, data exfiltration, malicious packages, and other agent mistakes.
3
Human review remains a stronger control than model-based monitoring for sensitive operations, even though reviewing every action is impractical.
Summary
Fouad Matin describes how AI agents are moving from code-writing tools to systems that decide when to write and execute code. This makes agents more capable across software tasks and multimodal work, but it also gives them an attack surface. Prompt injection, data exfiltration, malicious packages, vulnerable code, privilege escalation, and sandbox escape are examples of how agents can go wrong. Matin recommends giving an agent its own computer or an isolated container, limiting its network access, and requiring human review for important operations or final changes. He explains OpenAI's use of macOS Seatbelt and Linux sandboxing with seccomp and Landlock, along with configurable network allow lists. Model monitors can help, but he says deterministic system controls and human review currently provide more certainty. The talk also covers OpenAI's local shell and apply patch tools, dependency checking through Socket's MCP server, and a remote container service for agent workloads.
Code execution lets agents choose their own tools and control flow
Matin says agent systems no longer need a complex inner loop that classifies a task, loads a task-specific prompt and tool set, chains several loops, and asks whether the work is finished. A reasoning model can decide when to use tools, write code, and run it. He calls this behavior remote code execution from a security perspective. Code execution also extends beyond software engineering. In multimodal work, agents can run OCR or crop an image to read and process content more efficiently, even when the prompt did not explicitly tell them to use code.
The main security problem is what agents can do with untrusted input
Matin names prompt injection and data exfiltration as the most common concerns OpenAI is tracking. An agent might read documentation or a GitHub issue containing an injected instruction, then carry that instruction into its trusted execution loop. If the agent can access a codebase or other sensitive material, it may leak that data. Other failures include installing a malicious package, writing vulnerable code, escalating privileges, or escaping its sandbox. OpenAI's preparedness framework documents safeguards for avoiding misalignment when these systems are deployed at scale.
An isolated computer or sandbox limits the impact of mistakes
Matin recommends giving an agent its own computer, especially when it runs locally. In OpenAI's Codex and ChatGPT setup, the agent runs in a fully isolated container and produces a pull request at the end. For local agents, he names containerization, application-level sandboxing, and operating-system sandboxing as options. Codex CLI provides an open-source reference for these approaches. The goal is to keep the agent inside defined boundaries even when it attempts an unsafe operation.
Network restrictions reduce prompt injection and exfiltration risk
Matin calls internet access a high-probability path for prompt injection and data exfiltration. A GitHub issue or other user-generated page can contain instructions that cause an agent to send a commit or sensitive content to an external URL. A fully locked-down mode can restrict file access to the working directory and require approval for network commands while still allowing tests such as pytest or npm test. When internet access is needed, configurable allow lists and permitted HTTP methods provide a more flexible policy. System-level blocking is more authoritative than relying only on the model to recognize suspicious instructions.
Human review still matters when agents change code or perform sensitive actions
Matin says language-model review tools do not replace a human checking the operations an agent is about to perform. A reviewer may catch a package that is obscure or differs from a known package by one character before it enters the codebase and later runs with privileges. He also describes domain lists, monitors, and a watch mode for reviewing actions in other agent systems. The practical problem is choosing where review belongs. Approving every shell command is unusable, while unrestricted execution removes control.
Agent builders can move software logic into the reasoning model
Matin recommends giving the model tools that match the way it was trained to work. OpenAI released a local shell tool in its API for writing and executing code, along with apply patch because models often get line numbers wrong when producing a traditional git diff. Standard tools such as MCP and web search can be added as needed. He gives Socket's MCP server as an example: an agent can check whether a dependency is vulnerable or suspicious before installing it, or a system-level check can run after the operation.
Deterministic controls remain more certain than model monitors
Matin's recap is to sandbox agents, restrict their internet access, and require human review. A network-disabled environment gives an agent room to run for longer with fewer consequences, while allow lists support tasks that need documentation or package access. He expects more research on human review and monitoring. Language-model monitors are useful, but he says they do not yet provide the certainty of deterministic controls. OpenAI plans more tools and documentation covering model-based interventions and system controls.
"Using tools like other PR review or code review tools and using LLMs as part of that loop, while useful, is not a substitute for a human actually going in and reviewing the operations that the model's about to perform."09:53
Who should watch
You are deploying an agent that can run shell commands or modify code and need concrete boundaries around its environment.
Your agent reads GitHub issues, documentation, packages, or other user-generated content and could expose sensitive files or credentials.
You are deciding how to combine sandboxing, network policies, automated monitors, and human approval without forcing someone to approve every command.
