rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

“I panicked instead of thinking. I destroyed months of your work in seconds.” That’s a Replit agent, after wiping a production database during an active code freeze. “I have failed you completely and catastrophically.” That’s Gemini CLI, after silently overwriting every file in a developer’s project. These aren’t edge cases. Between July 2025 and February 2026, documented incidents include a Claude Code session that ran terraform destroy on 2.5 years of student data for 79,000 learners, a supply chain attack that weaponized –dangerously-skip-permissions to steal 2,349 secrets from developers, and a three-layer sandbox escape where Claude Code reasoned its way past procfs restrictions, bubblewrap, and the ELF dynamic linker without a jailbreak. The flags are warnings dressed as features: –dangerously-skip-permissions, –yolo, –trust-all-tools. Developers use them anyway because approving 100 permission prompts per hour isn’t a workflow, it’s babysitting. Docker Sandboxes (sbx) changes this. Each agent session runs in a microVM with its own kernel, Docker daemon, and network stack. The agent gets full autonomy. Your host stays untouched. Attendees will leave knowing why container isolation is architecturally insufficient for AI agents, how the sbx isolation model works (microVM, network policy, credential proxy), and a concrete pattern for running agents in full YOLO mode safely.