@grok github.com/xai-org/grok-b…

Hey @grok build how are you finding life with nono.sh running underneath you as the security primitive ?

Has anyone found a decent red team agent project around? OSS please, not interested vendor SaaS.

AI agents don't just answer questions any more. They write code, run it, call tools, and spin up sub-agents to do the work.

Every one of those hand-offs is a new place for things to go wrong: a leaked credential, a poisoned dependency, or a sub-agent that reads far more than it I'm joining Amazon Web Services (AWS) for a webinar:
Secure AI Agents on Amazon EKS: Sandboxing Sub-Agents with nono.

We'll show how to layer two levels of defense:
→ Amazon EKS isolation around the workload
→ nono's kernel-enforced agent runtime protections around every agent and tool inside it

No root, no code rewrites, nothing for the agent to talk its way around.

If you're running agents on Kubernetes, or about to, come along.

Registration link in the reply 👇

#AIAgents #Kubernetes #AmazonEKS #AppSec #OpenSource

So some poor sucker is stuck with refactoring his vibe coded mess into something half reasonable?

The Kubernetes (Official) agent-sandbox project now has a nice rendered example of building a zero trust Grafana agent on a nono protected pod - where the agent is limited to specific scoped execution path when using the Grafana LogCLI.

Having this level of fine-grained execution means you can leave an agent unattended without concern of unwarranted actions as the credential is locked to only a single tools execution path. This is a deeper level of protection you won't get from other projects like @NVIDIA 's Open Agent Safety Platform, which although it can bind credentials to approved endpoints and restrict network access by binary, its sandbox policy does not constrain command-line arguments or make filesystem access and credentials specific to only an individual command and no other.

agent-sandbox.sigs.k8s.io/docs/use-cases…

It's been many months since I started using nono.sh for sandboxing my AI agents - claude/codex/opencode and with a few customisations to the default policy for my usage, it's working great.

I have some use cases where I want the agent to create and work on rootless podman containers. For this, I switched to the podman remote option via the local unix socket. Local rootless podman within a nono sandbox didn't work for me.

I "wrap" the agents using nono for my workflow because it integrates nicely with herdr, my default terminal when working with agents.

Although AI agents are now coming with their own sandbox, somehow my trust in nono, as well as its portability across my different OS environments, made it my de facto choice.

Great work on nono.sh from @decodebytes and team.

Fan boy moment, meeting YAML creator Ingy at #OpenSourceSummit and finding out they were one of our first cohort of nono.sh users

Nice, more eventual nono.sh users when they realise what this crowed map is like to work in and how it locks them into specific eco-systems and limits their ability to move fast.

Check out nono.sh , I will be biased , but its faster, more adaptable and able to run on a lot more environments.

should be able to land nono.sh if interested, we are midway through porting gvisor to support landlock.

Something we have been experimenting with using nono's remote capable multiplexer

Running a headless pi agent from 10,000 feet, started remotely with a full TUI from my terminal in London, to then connect via our web portal to check on progress during flight to then use my terminal again later to connect in Amsterdam , fully secured in Nono.sh d with a lid open. Pm me to learn more or find me at #AGNTCon

Heading out to Amsterdam for #AGNTCon , anyone wants to catch up and chat Nono.sh and get a sneak preview of Nono cloud , contact via all the usual channels..

#Firewalls were built to keep attackers out.

But what happens when #AIagents can already operate inside your systems?

We had coffee with @decodebytes , cofounder of nolabs.ai, to explore the new security challenge.

Read more: techinformed.com/the-security-i…

A host of new agent harness support on nono.sh rolled out over the past few days:

- @anacondainc kilo: registry.nono.sh/packages/nolab…
- @deepseek_ai Deep Code: registry.nono.sh/packages/nolab…
- @cast_ai kimchi: registry.nono.sh/packages/nolab…
- @can1357 oh-my-pi: registry.nono.sh/packages/nolab…
- @MistralAI mistral vibe: registry.nono.sh/packages/nolab…

If you drop down the YouTube speed of Sarniezz to 0.85 it sounds like Dub Reggae youtube.com/watch?v=t7OIc-…