🤖 AI Summary
Large language models (LLMs) operating as autonomous coding agents face critical security risks—including execution of destructive commands and system state inconsistency—while existing commercial solutions rely on manual approval, undermining autonomy. Method: We propose a fault-tolerant sandbox tailored for AI agents, pioneering the integration of database transaction semantics into the agent execution layer. It features a policy-driven command interception layer that blocks high-risk instructions in real time with 100% efficacy, coupled with a transactional filesystem snapshot mechanism ensuring atomic execution and guaranteed 100% rollback upon failure. Contribution/Results: Built upon nano-vLLM for lightweight inference, Proxmox-based virtualization, and EVPN/VXLAN network isolation, the system achieves strong consistency and low latency without human interaction—each transaction incurs only 1.8 seconds overhead (14.5% increase), substantially overcoming the autonomy bottleneck inherent in current CLI sandboxes.
📝 Abstract
The transition of Large Language Models (LLMs) from passive code generators to autonomous agents introduces significant safety risks, specifically regarding destructive commands and inconsistent system states. Existing commercial solutions often prioritize interactive user safety, enforcing authentication barriers that break the headless loops required for true autonomy. This paper presents a Fault-Tolerant Sandboxing framework designed to mitigate these risks through a policy-based interception layer and a transactional filesystem snapshot mechanism. We hypothesize that wrapping agent actions in atomic transactions can guarantee safety with acceptable latency, outperforming the heavy initialization overhead of containers or the interactive friction of commercial CLIs. We validated this approach by deploying the Minimind-MoE LLM served via nano-vllm on a custom Proxmox-based testbed utilizing EVPN/VXLAN isolation. Experimental results demonstrate a 100% interception rate for high-risk commands and a 100% success rate in rolling back failed states. Crucially, our prototype incurs only a 14.5% performance overhead (approx. 1.8s) per transaction. In contrast, benchmarking against the Gemini CLI sandbox revealed that it requires interactive authentication ("Sign in"), rendering it unusable for headless, autonomous agent workflows.