WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
Coffee With Developers • Mar 4, 2026

Securing AI Agents from the Ground Up - Luke Hinds

Luke Hinds

Luke Hinds proves that application-level guardrails cannot secure autonomous AI agents. Learn how to implement OS-level sandboxing with Nono to protect your local environment from catastrophic terminal operations.

Pause
Mute Enter Fullscreen
#1 about 5 min

Background on open source security software

Open source transparency and community collaboration provide essential oversight for building trustworthy security software.

#2 about 5 min

Why AI development prioritizes speed over security

The massive rush to dominate the generative AI market leads developers to systematically deprioritize foundational application security.

#3 about 2 min

Risks of running black box AI tools locally

Inexperienced engineers often grant unvetted AI applications excessive terminal access without understanding the system-level consequences.

#4 about 5 min

Determining where autonomous AI agents actually add value

Complex agentic AI implementations are frequently unnecessary when foundational software patterns can solve the same problems faster.

#5 about 9 min

Origin and architecture of the Nono sandboxing tool

The Nono application leverages Linux kernel security modules to explicitly isolate unverified AI processes from operating systems.

#6 about 5 min

Demonstrating file access restrictions with the Nono command-line

The command-line interface makes it explicitly straightforward to authorize or forbid directory permissions for isolated applications.

#7 about 3 min

Containing Claude Code within a secure sandbox environment

Running a Claude Code agent inside a restrictive sandbox safely educates users when the tool attempts unauthorized commands.

#8 about 2 min

Reverting agent damage with automated snapshot rollbacks

Built-in file tracking networks allow developers to rapidly undo destructive code modifications executed by unpredictable AI agents.

#9 about 2 min

Preventing API key exfiltration natively with phantom keys

Injecting randomized string values guarantees malicious applications cannot correctly exfiltrate valid API keys to external unauthorized servers.

#10 about 6 min

Blocking browser cookie theft and dangerous terminal commands

Explicit logging requirements and hardcoded process constraints protect host machines against stolen session states and rogue file deletions.

#11 about 6 min

Balancing smooth user experience with strict security practices

Punishing engineering groups with burdensome authentication patterns fundamentally motivates individuals to disable security parameters to remain productive.

#12 about 8 min

Lessons on simplifying cryptographic signing and encryption adoption

Transforming tedious encryption workflows into seamless background utilities vastly accelerates security integration across large developer ecosystems.

#13 about 3 min

Engaging developer communities to solve emerging security threats

Providing lightweight solutions directly in chat channels enables security advocates to safely scale software adoptions.

Matching moments

3:22 min

Evaluating security risks and capabilities of the agentic web

Meta Atamel +1 · Coffee With Developers

4:15 min

Security integration and AI skepticism in developer tooling

Chris Heilmann +2 · LIVE

2:28 min

Mitigating excessive agency through scoped tool access

Deepu Deepu · WWC 2025

1:55 min

Current state of security in AI applications

Deepu Deepu · WWC 2025

6:05 min

Running autonomous AI desktop agents entirely within the browser

Chris Heilmann +2 · LIVE

1:58 min

Using Open Shell for AI agent governance and isolation

Rob Nertney Rob Nertney · WWC Europe 2026

More from Coffee With Developers

What to Do About Hackathons in the Time of Agents - Mike Swift thumbnail
46:03
9 days ago

What to Do About Hackathons in the Time of Agents - Mike Swift

Mike Swift

Moving from Playing with AI to Implementing AI - Lee Stott thumbnail
18:43
13 days ago

Moving from Playing with AI to Implementing AI - Lee Stott

Lee Stott

Evals vs. Evil - AI and Package Security - Laurie Voss thumbnail
16:57
22 days ago

Evals vs. Evil - AI and Package Security - Laurie Voss

Laurie Voss

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert thumbnail
4:57
27 days ago

Burning Satellites, Talking Plants and Agents Hiring Each Other - Fake or News with Matt Zeunert

Matt Zeunert

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify) thumbnail
40:29
about 2 months ago

Web Scraping, AI Agents, and the Future of Open Source - Kevin Lewis (Apify)

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel thumbnail
32:22
about 2 months ago

Making Teaching Code Less Academic and More Market-Ready - Peter Ruppel

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

Responsible AI Architecture with Zero Trust Agents

Ashok Prakash

Staff ML Engineer at Apple

Ashok Prakash
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

Give the Agent a Budget, Not a Token

Sachin Malhotra

MTS @Anthropic

Sachin Malhotra

Related videos

Agentic AI: building autonomous systems for developers thumbnail
28:58
WWC Europe 2026 • about 1 month ago

Agentic AI: building autonomous systems for developers

Anshul Jindal, Sebastian Mahr

The day the chatbot asked for sudo thumbnail
27:48
WWC Europe 2026 • about 1 month ago

The day the chatbot asked for sudo

Alex Olivier

Building, securing and governing AI infrastructure in the Era of Agentic AI thumbnail
27:13
WWC Europe 2026 • about 1 month ago

Building, securing and governing AI infrastructure in the Era of Agentic AI

Rob Nertney

YOLO Developer Workflows with a Coding Agent in a Box thumbnail
28:58
WWC Europe 2026 • about 1 month ago

YOLO Developer Workflows with a Coding Agent in a Box

Manuel de la Peña

Fighting the Next Wave of Cybercrime thumbnail
30:27
WWC Europe 2026 • about 1 month ago

Fighting the Next Wave of Cybercrime

Michele Zuccala, Misha Bragin, Ross Kukulinski, Frank Schlesinger, Tomislav Tipurić

The New AI Security Stack: Observe, Detect, Protect thumbnail
30:16
WWC Europe 2026 • about 1 month ago

The New AI Security Stack: Observe, Detect, Protect

Milin Desai, Christian Trummer, Jyoti Bansal, Tomislav Tipurić

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.