Sandboxing Tool-Using AI Agents: Network Egress, DNS, and Least Privilege
Your agent's container says 'no internet', but can it resolve DNS? A practical guide to containing tool-using AI agents: deny-by-default egress, a controlled resolver, scoped credentials, and audit logs.