Pick Your Sandbox: Why Isolation, Identity, and Policy All Have to Work Together

Sandboxing is the easy part. The hard part is everything around it. In this panel, Alex Zenla (Edera CTO), Jon Ceanfaglione (Sparrow Labs), and Timothy St. Clair (Raikiri) dig into what it actually takes to secure AI agents and container workloads when the threat landscape changes daily. They cover the unsustainable pace of CVE patching, why AI agents now match nation-state attack capabilities, and why a sandbox alone is not a security strategy. The conversation moves from the current state of vulnerabilities — GitLab patched three times in a week, PHP deployments that will never be updated, a hospital turning away ambulances after a ransomware attack — to what isolation actually means at the kernel and hardware level, including CPU cache side-channel attacks discovered by AI agents. The panel lands on a clear thesis: containment is necessary but insufficient. You need identity, scoped authorization, policy enforcement, immutability, rotation, and monitoring working together. Defense in depth is not optional. 0:00 Introduction 0:13 Alex Zenla — Edera CTO 2:04 Jon Ceanfaglione — Sparrow Labs 2:53 Timothy St. Clair — Raikiri 4:55 The current state of security threats 6:22 AI agents as nation-state-level attackers 12:00 AI agent risk vs. vulnerability risk 14:28 Real-world impact: hospitals, critical infrastructure 16:13 The unsustainable pace of patching 20:49 Pets vs. cattle and the automation gap 25:20 Reducing the trusted computing base 26:33 Will AI ever find all vulnerabilities? (Vuln Zero) 33:31 Shifting to solutions: what is isolation? 34:26 Kernel-level isolation vs. mitigation 35:12 Hardware isolation and shared cache problems 37:19 CPU cache side-channel attacks by AI agents 40:50 Is sandboxing enough? 41:50 Policy enforcement and scoped credentials 43:35 IAM, identity, and authorization for agents 45:15 AI safety classifiers: are they sufficient? 50:37 Sandboxing agents that need internet access 57:09 Key takeaways Edera builds a container-native Type-1 hypervisor that gives each workload its own kernel-level isolation boundary. No shared kernel. No container escapes. No workflow changes. Learn more: https://edera.dev