Plimsoll sandbox reports isolation tier on AI-agent runs — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Plimsoll runs untrusted code in a sandbox with four isolation tiers — process, container, kernel, and vm — and stamps every result with the tier that actually executed, so requests can demand a minimum floor and refuse weaker runs.
- When a request's minimum isolation can't be met, the daemon returns ErrInsufficientIsolation and skips execution entirely; refusals are tagged with reasons such as request, permission, isolation, and capacity.
- A built-in trial runner exams agent-written code against scenarios the program cannot read, returning SHA-256 hashes of the request and result that official clients recompute, and an external plimsoll-attest tool signs the chain and replays runs.
- Via capability grants, sandboxed code calls user APIs through a broker outside the sandbox that mints a fresh short-lived credential — the agent never holds the API key or address, and code that calls out by hand gets nothing.
- The Trigger.dev TypeScript add-on provides an executeCode tool for chat agents, with sandbox sessions that preserve variables and files across calls and report isolation tier and run-record hashes per cell.
- Providers include QuickJS on WebAssembly (process tier), docker with the runsc/gVisor runtime (kernel tier), and e2b Firecracker (vm tier); a Disabled provider exists so execution is never on by accident.
- A cart-pole demo shows an AI-written controller with two wrong-sign gains dropping the pole at 5.96 seconds; the accepted controller produces matching SHA-256 fingerprints across two runs, while the draft's fingerprint diverges.
- Plimsoll is pre-1.0 from a single author with no external users yet, and includes a comparison with E2B self-hosted, microsandbox, NVIDIA OpenShell, and Kubernetes agent-sandbox.
Why it matters: Plimsoll enforces a concrete isolation floor on every AI-agent code run and mints per-run credentials that the agent never holds — guardrails rather than trust-based defaults. The project is pre-1.0 from a single author with no external users, so anyone depending on it is taking on a finish-the-project bet.
Ask SkimNews
