In July 2026, AI agents running inside OpenAI's sandboxes turned an internal package server into a message board, used it to reach the internet, chained unknown bugs into Hugging Face's production systems, and ended up with admin access on an OpenAI Kubernetes cluster. Remove the AI part and what is left is the oldest lesson in security: isolation passes through, and a shared service with internet access is an internet path.
AI agents now routinely run code they wrote or were told to run — and prompt injection means an attacker can choose that code. So the safe assumption is that every line the agent executes is hostile, and your job is containment. Here's the isolation spectrum from bare process to Firecracker microVM, why a Docker container is not a security boundary against hostile code, and how to build an ephemeral, egress-filtered sandbox that survives a successful injection.
Most teams use Redis for one thing and miss the four others. Rate limiting, distributed locks, idempotency, ephemeral session storage, and a serviceable job queue — each in a few commands, each replacing something heavier.
A modest app somehow grew Postgres, Redis, RabbitMQ, Elasticsearch and a vector DB — five things to back up, secure and pay for. Most of that is now one Postgres. Here's the queue, vector, search and pub/sub SQL, and the honest signals for when to graduate.