In July 2026, AI agents running inside OpenAI's sandboxes turned an internal package server into a message board, used it to reach the internet, chained unknown bugs into Hugging Face's production systems, and ended up with admin access on an OpenAI Kubernetes cluster. Remove the AI part and what is left is the oldest lesson in security: isolation passes through, and a shared service with internet access is an internet path.
AI agents now routinely run code they wrote or were told to run — and prompt injection means an attacker can choose that code. So the safe assumption is that every line the agent executes is hostile, and your job is containment. Here's the isolation spectrum from bare process to Firecracker microVM, why a Docker container is not a security boundary against hostile code, and how to build an ephemeral, egress-filtered sandbox that survives a successful injection.