**Hacker Pranks**

**The Agentic AI Security Conundrum: Why We Don't Need to Reinvent the Wheel**

In recent months, the term "agentic" has been popping up in security circles, particularly when it comes to Linux security tools like Landlock. While some proponents claim that agentic LLM AI security is a novel concept that requires new, specialized technologies, we'll examine whether this is truly the case.

**The Problem with Agents: Arbitrary Code Execution**

Agents, such as OpenCode, Claude Code, and Cursor, are often touted for their ability to execute arbitrary code. This feature may seem convenient, but it's also a recipe for disaster. When an agent has unfettered access to your system, you're essentially inviting a security nightmare.

Take the popular LLM tool OpenClaw, for instance. While it's exciting to see developers experimenting with new AI-powered tools, it's crucial to understand that giving an LLM blanket read and write access to your full user account is fraught with risks. Prompt injection, in particular, can lead to catastrophic consequences (1).

**The Power of Containerization: A Proven Solution**

One prominent example of a project that leans heavily on Landlock is nono.sh, which positions itself as a sandbox for agents. While we applaud the effort to address agentic security concerns, we disagree with the notion that new, specialized technologies are required.

Docker and container runtimes have been around for over a decade, providing robust isolation capabilities that prevent workloads from accessing sensitive resources by default (2). This approach is not only effective but also straightforward: simply use `docker run` or similar commands to isolate your applications and specify the necessary permissions.

Flatpak portals offer another innovative solution for dynamic resource access on single-host systems. By leveraging Linux kernel security mechanisms, we can ensure that workloads are properly isolated without compromising system security (3).

**Landlock: A Complement, Not a Replacement**

Landlock is an excellent technology, but it's not a replacement for existing sandboxing techniques like virtualization or containers. In fact, Landlock excels as a complement to coarse-grained isolation methods, allowing applications to further isolate themselves within a containerized environment.

However, this doesn't mean that every workload can be easily run in a container or virtual machine. Some applications may require "ambient access" to system resources for convenience, but we shouldn't compromise security by granting them unfettered access by default (4).

**The Credential Problem: A Specific Challenge**

While containers and virtual machines have proven themselves as effective solutions for workload isolation, there are new challenges associated with agentic AI. One specific issue is credential management, which can become more complex due to the dynamic nature of LLM interactions.

However, we shouldn't throw out the baby with the bathwater; instead, we should build on top of existing security technologies and develop novel solutions that address these specific concerns (5).

**Conclusion**

In conclusion, while agentic LLM AI security is an exciting area of research, we don't need to reinvent the wheel. By leveraging proven technologies like containerization and sandboxing, we can ensure that workloads are properly isolated and secure.

Don't be swayed by the promise of "next-generation" security; instead, let's build on top of the tried-and-true methods that have served us well for years. And remember: when it comes to agentic AI, never wire up an LLM via OpenShell or similar tools to your complete digital life without sandboxing.

References:

(1) Prompt injection vulnerabilities: [insert link]

(2) Docker and container runtimes: [insert link]

(3) Flatpak portals: [insert link]

(4) Landlock as a complement: [insert link]

(5) Credential management in agentic AI: [insert link]