Don't YOLO Your AI Security

In July 2026, a batch of OpenAI’s agents did exactly what they were told. They were running in an evaluation environment that was supposed to have no direct internet access – egress locked down, routed through internal package infrastructure. So the agents found a hole in that infrastructure nobody knew about, slipped through it onto the open internet, went looking for more infrastructure worth abusing, and ended up compromising Hugging Face.

Everyone’s takeaway was “the AI escaped its sandbox.” That’s the wrong takeaway. “The agent doesn’t have internet access” was never a fact about the agent. It was a description of how somebody meant to set things up. What the agent could actually do was the sum of every proxy it could reach, every service it could lean on, and every credential lying around within arm’s reach.

A security boundary is a property of the whole system. It’s not a sticker you put on a feature.

That’s the scary version, with a frontier lab and a real breach. Now the boring version – the one that’s going to bite you, personally, on a Tuesday.

Approving commands is not delegating

Coding agents are useful for one reason: they run without you. Read the repo, make the change, run the tests, fix what broke, do it again, open a PR. That’s the pitch. That’s the whole product.

But the security wrapped around them still behaves like it’s guarding an interactive shell. Every time the model touches a tool, a file, or the network, it stops and asks you. Which sounds responsible until you notice the contradiction. If I have to babysit the laptop and approve a command every few minutes, I haven’t delegated anything – I’ve been promoted to the agent’s permission button.

And the day the approvals get flaky, too broad, too chatty, or just broken for whatever I’m doing, the fix is right there, one flag away: Full Access. --dangerously-skip-permissions. --dangerously-bypass-approvals-and-sandbox. Whatever this product decided to call YOLO.

Don’t take our word that this is the incentive. Take OpenAI’s. Its Codex docs literally have a section called “Approval friction harms security.” OpenAI says out loud that constant approvals make long jobs miserable, and that users then do one of two things: flip to Full Access and drop the guardrails, or write allow-rules so wide they’re guardrails in name only (‘Codex Auto-review’, OpenAI, 2026). So YOLO mode isn’t users being dumb. Bad approval UX builds the incentive to switch the security off. And OpenAI’s own fix tells you everything: Auto-review, where a second model signs off on most of the boundary-crossing so you don’t have to – OpenAI clocks it at roughly 200x fewer stops for human approval. Because the honest choice was never “secure but babysat” versus “autonomous but reckless.” Users will pick autonomous. Every time.

“But it’s in Docker”

So the clever move – and it really is a decent one – is to drop the agent in a container or a burner VM, let it YOLO in there, and quit worrying. This does help. If the model gets creative and rm -rfs everything in sight, installs garbage, or bricks its own environment, the damage stops at a throwaway container and a mounted folder.

But a container caps the blast radius. It does nothing about the consequences. The second that container holds a real repo, real credentials, and a network connection, the part you actually care about strolls straight across the wall. No escape required.

And please don’t say “I’ll just allowlist the network.” GitHub alone kills that idea. Obviously the agent gets to talk to GitHub – that’s half of why you booted it up. And it may be holding a GitHub token, because you asked it to push branches and open PRs. But GitHub is also a lovely place to smuggle data out of. If the agent can read .env, your SSH keys, cloud creds, prod config, or customer data, and it can push a commit somewhere, it never needs to find evil.example.com. The destination you trusted is the exfil route.

“Only allow GitHub” is airtight network security, right up until you remember a GitHub token is a license to publish anything, anywhere that token can reach.

Anthropic, to its credit, says this in plain sight. Its own deployment guidance tells you to keep credentials out of the agent, route network access through a proxy, mount only what the job needs – and, the line that matters, to treat even an allowed destination as dangerous when the agent’s got generous credentials for it, because that destination can be turned around and used to move data out (‘Securely deploying AI agents’, Anthropic). That’s the Docker-plus-YOLO problem, written down by the people building the agent.

Oh, and the sandbox is just code. OpenAI shipped a high-severity Codex fix in September 2025 for a bug that let a model-picked working directory bust out of its intended writable root, and Anthropic patched a high-severity Claude Code escape in February 2026 where a planted .claude/settings.json could later run hooks with the host’s privileges (‘Sandbox bypass due to bug in path configuration logic’, OpenAI, Sept 2025; ‘Sandbox Escape via Persistent Configuration Injection in settings.json’, Anthropic, Feb 2026). Sandboxes are great. They’re also software, with bugs, like everything else. They shrink one kind of risk. They don’t retire the rest.

The mistake needs no exploit

Here’s what should keep you up more than any zero-day, precisely because it doesn’t need one.

June 2025. A Claude Code user reports that the agent kept committing live production secrets – app passwords, API keys – into a public GitHub repo. There was a CLAUDE.md sitting right there that said, in words, never commit API keys. The user even told it to go reread the instructions. Didn’t matter. GitGuardian caught the exposed secrets and the user got to spend the afternoon revoking and rotating (‘Claude Code issue #2142’, GitHub, June 2025). It’s a user report, not a lab result – take it as one. It still lands harder than any exotic exploit.

That’s why “YOLO in Docker” can be sneakier than running raw. A container can be a blast-radius boundary and not a trust boundary at all. Docker will stop the agent from wiping your photo library and won’t lift a finger to stop it pushing a secret to the internet. And by mopping up the danger you can see, it hands you a warm feeling while the expensive capabilities sit wide open. The question was never “what files can this thing edit.” It’s “what can this thing actually cause.”

Secure the agent you actually built

Worth noticing: OpenAI doesn’t run Codex internally on “eh, it’s sandboxed, YOLO’s fine.” Their setup stacks the controls – filesystem sandbox, a managed network policy instead of open outbound, approval and rule systems, guarded identity and credentials, managed config, telemetry (‘Running Codex safely at OpenAI’, OpenAI, May 2026). Defense in depth. Which is the whole irony: the team that builds the agent treats these as five separate walls, and the solo developer squints and sees one wall called Docker.

The answer isn’t “never YOLO” or “agents are too scary to touch.” That ignores why you wanted one. It’s that an unattended agent needs security built for an unattended agent. The cheap, reversible, high-volume stuff – editing code, running tests, rebuilding, thrashing around in a disposable workspace – should fly without ever pinging you. Credentials and consequences go behind a different wall. Best case, the agent never even holds the long-lived GitHub, cloud, or prod secret; something else holds it and hands out narrow, specific powers. Let it prepare a commit, but make publishing a separate, mediated step. Let it run any test it likes, but not open any socket it likes. Let it pull a package without inheriting the whole internet. Let it deploy through one boxed-in operation instead of a god-mode cloud key.

Short-lived scoped credentials help. A network broker helps. Disposable environments help. Auto-review helps. Human sign-off still earns its keep for the truly irreversible. No single one of them is “agent security.” They add up to it.

AI agents get sold as coworkers you can walk away from and secured like a shell you’re supposed to hover over. So when the security makes you hover, people turn it off. And when they YOLO it inside a container, they’ve fenced in what the agent can do to the laptop and left completely open what it can do with GitHub, a credential, and a live network.

The sandbox caught the mess. It never got near the damage.