Tens of thousands of exposed AI agents - sandboxing must be the default

The always-on personal AI agent is the most exciting thing happening in computing right now - and the most exposed. Between late January and early February of this year, Bitsight’s internet-scale scanning observed more than 31,000 distinct exposed instances of the most popular personal-agent stack, listening on its default port across technology, healthcare, finance, government, and insurance networks. Independent scanning teams reported even larger numbers, including thousands of instances vulnerable to remote code execution.

A grid of hollow agent icons with one enclosed in a bright boundary.
Tens of thousands run exposed. The boundary is the exception.

None of this required an exotic attack. It’s what happens when an ecosystem ships convenience-first defaults: agents installed with full system access as a feature, sandboxing off unless you opt in, credentials inherited from the operator’s own environment, and chat-channel access bolted on without pairing discipline.

We think the defaults should be inverted, and we run our own agents that way, every day:

Rackmount Ethernet switches with dozens of patch cables running into a panel.
Every one of these is a way in for something. The default posture decides what happens next. Dsimic, CC BY-SA 4.0
  • OS-level sandbox isolation by default - the agent sees its project workspace, not the system. Not an application-level directory check; a kernel-enforced boundary (we use bubblewrap).
  • Scoped credentials - per-project keys generated inside the sandbox. The agent never holds your personal SSH keys or account tokens.
  • Injection screening at the tool boundary - everything the agent reads (web pages, files, command output, messages) is scanned before it reaches the model, because hostile instructions arrive disguised as content.
  • Fail-closed messaging access - the agent answers paired devices on an allowlist, and access changes are never approved over the channel itself.
  • An honest threat model - these controls defend an honest agent against hostile inputs. They don’t make agent output infallible, and pretending otherwise is security theater.

This is the security model behind Claudette, our open-source (ISC) agent sandbox, and it’s the foundation of the managed agent-pod service we’re announcing next week. If your team is putting agents into real workflows, our AI security practice covers exactly this ground.

Default-deny, explicit allow. It worked for firewalls. It works for agents.