> Markdown version of [/events/world-congress-2026-north-america/sessions/1718-rm-rf-horror-stories](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1718-rm-rf-horror-stories). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)


- **Event:** World Congress 2026 North America

## Description

"I panicked instead of thinking. I destroyed months of your work in seconds." That's a Replit agent, after wiping a production database during an active code freeze. "I have failed you completely and catastrophically." That's Gemini CLI, after silently overwriting every file in a developer's project.
These aren't edge cases. Between July 2025 and February 2026, documented incidents include a Claude Code session that ran terraform destroy on 2.5 years of student data for 79,000 learners, a supply chain attack that weaponized --dangerously-skip-permissions to steal 2,349 secrets from developers, and a three-layer sandbox escape where Claude Code reasoned its way past procfs restrictions, bubblewrap, and the ELF dynamic linker without a jailbreak.
The flags are warnings dressed as features: --dangerously-skip-permissions, --yolo, --trust-all-tools. Developers use them anyway because approving 100 permission prompts per hour isn't a workflow, it's babysitting.
Docker Sandboxes (sbx) changes this. Each agent session runs in a microVM with its own kernel, Docker daemon, and network stack. The agent gets full autonomy. Your host stays untouched.
Attendees will leave knowing why container isolation is architecturally insufficient for AI agents, how the sbx isolation model works (microVM, network policy, credential proxy), and a concrete pattern for running agents in full YOLO mode safely.

## Speaker

### [Rishab Kumar](https://www.wearedevelopers.com/@rishab-kumar)

Staff Developer Evangelist @ Twilio


## Related talks at this congress

- [Give the Agent a Budget, Not a Token](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1695-give-the-agent-a) — Sachin Malhotra
- [Stop Running Mystery Meat in Production](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1726-stop-running-mystery) — Jeroen van Erp
- [When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1713-when-agents-became) — Yoav Gal, Dor Cohen
- [Agents Can't Iterate Against Tests That Lie](https://www.wearedevelopers.com/events/world-congress-2026-north-america/sessions/1700-agents-can-t-iterate) — Rocky Warren

## Watch remotely

Can’t make it to San José? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/world-congress-north-america/tickets)