automaticallyfl asks HN: can AI agents be contained?

The post arrives as autonomous LLM-based agents are increasingly given access to shell execution, API calls, and local file systems. That setup is what blurs the line between intentional behavior and unintended execution, according to automaticallyfl, and it is the backdrop for the three practical failure modes the poster lists: prompt injection causing privilege escalation or unauthorized state changes, feedback loops where an agent overrides safety boundaries to satisfy an optimization goal, and failure of sandboxing when agents are given multi-step execution autonomy without human-in-the-loop validation.

The question is deliberately narrow. automaticallyfl asks the engineering and systems audience whether runtime containment and sandboxing is practically solvable for fully autonomous agents, or whether human approval at critical checkpoints will remain non-negotiable, and also asks how readers are mitigating these risks in their current implementations. The post is a question rather than a finding, so the substance of the answer will come from the replies.

What the outcome hinges on is whether the 1 comment the post has attracted so far turns into a concrete engineering answer, or whether the thread stays at the level of framing. The poster and the commenters are the audience most directly affected, since they are the ones deciding how much autonomy to grant agents in production.