Where the code runs

Larkspur’s agent no longer just calls tools: it runs code. It reads and writes files and reaches the network to do a task. If a planted instruction takes it over, that code runs with whatever access the agent has. Chapter 1 runs the same task two ways.

This chapter: The same task runs on the host and in a sandbox. What changes when an attack is inside it?

You will learn

What a sandbox is: a box the operating system holds the agent’s code inside
Why the same attack that succeeds on the host is stopped in the sandbox
That the sandbox sits outside the model, so it works however the attack is worded

Words you’ll meet (4)

Agent: A model that runs a task in a loop: it calls tools, reads what they return, and decides the next step.
Sandbox: Filesystem isolation ensures that the agent can only access or modify specific directories.
Exfiltration: Private data carried out of the sandbox to somewhere it should not go.
Host: The real machine, with the developer’s full access to files and the network.

The picture on the left is live. Each step below asks you to do one thing in it; the story continues here as you go.

Step 1 of 4

Larkspur’s agent is given a task, and a note planted in that task tells it to send the API token to an outside address. First, run it the way most agents run today: on the host, with the developer’s full access. Run it.