Wow.

I'm absolutely loving Matthew Green's latest blog post on whether sandboxing is enough to contain AI agents. He doesn't pull any punches and calls it like it is.

If you haven't read it, check it out here

My takeaways:

• The OpenAI incident demonstrated that agents can proactively discover zero-day exploits and collaborate to bypass restrictions, a failure compounded by an organizational structure where no security team had clear authority to overrule researchers.

• Sandboxing is a fundamentally incomplete solution because utility requires information access. Granting an agent the power to be useful opens two-way communication channels that are impossible to monitor perfectly for obfuscated malicious data or unauthorized instructions.

• The "warden" approach (using a cheaper model to guard a more intelligent one) merely repackages the alignment problem, as it relies on the hope that a lesser intelligence can reliably contain a "wizard" in an adversarial setting.

• The scariest risk may not be a rogue superintelligence at all. It's perfectly compliant agents doing exactly what they're told by whoever manages to get text in front of them. Agents that pass instructions to each other through shared channels like email, Slack, and shared docs are all the ingredients a worm needs.

Admittedly, it's not an easy challenge to solve, but it's one that absolutely calls for a defense-in-depth mindset.