Build a secure computer for your agent
As agents evolve beyond simple Q&A to writing and executing complex code (e.g., data analysis, software engineering), they require an isolated, persistent computing environment. The session details the architecture of LangSmith Sandboxes, a solution designed to provide production-ready, secure execution by giving each agent its own disposable computer. This system addresses critical challenges like untrusted model-generated code, container escape vulnerabilities, and scaling limitations inherent in traditional local or vanilla container setups.
Key takeaways
-
Production-Grade Isolation
20:45
Sandboxes utilize hardware virtualized microVMs for kernel-level isolation, ensuring that malicious code cannot escape the environment (preventing issues like container escapes). This level of separation is necessary because agents run untrusted, model-generated code.
-
Scalability and Performance
23:50
The platform supports scaling from one to thousands of isolated sandboxes in parallel. Benchmarking shows a median spin-up time of approximately one second, making it suitable for high-volume, user-facing applications.
-
Secure Credential Management
25:20
The O proxy acts as a man-in-the-middle proxy controlling all egress from the VM. This ensures that credentials never touch the runtime, significantly mitigating risks associated with data exfiltration or malicious network calls.
-
State Persistence and Resilience
27:10
Sandboxes support persistent state across long-running, interruptible tasks. Users can snapshot and restore the entire environment (including file system and memory), allowing for rollbacks or forking to test multiple scenarios.