> Markdown version of [/videos/1828-securing-ai-agents-from-the-ground-up-luke-hinds](https://www.wearedevelopers.com/videos/1828-securing-ai-agents-from-the-ground-up-luke-hinds). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Securing AI Agents from the Ground Up - Luke Hinds

Luke Hinds proves that application-level guardrails cannot secure autonomous AI agents. Learn how to implement OS-level sandboxing with Nono to protect your local environment from catastrophic terminal operations.

- **Speakers:** Luke Hinds
- **Event:** Coffee With Developers
- **Published:** March 4, 2026
- **Duration:** 56:27
- **URL:** https://www.wearedevelopers.com/videos/1828-securing-ai-agents-from-the-ground-up-luke-hinds

## Summary

The rapid rise of agentic AI has prioritized deployment speed over fundamental safety, leading developers to grant autonomous tools unfettered access to their local environments. As engineers increasingly hand over terminal controls to systems like Claude Code or OpenDevin, they risk catastrophic file operations, exfiltrated API keys, and browser session hijacking. Because application-level guardrails are easily bypassed, there is a critical need for structurally robust containment that protects the host machine without hindering the developer's momentum.

To address this vulnerability, open-source security expert Luke Hinds introduces Nono, a lightweight sandboxing utility designed to strictly constrain AI agents at the operating system level. Rather than relying on fragile code-based restrictions, Nono leverages foundational OS capabilities—specifically Linux Security Modules (LSM) and SecComp—to enforce a default-deny policy directly within the kernel. By treating agents as isolated processes, developers can safely run autonomous coding tools, trusting the sandbox to intercept unauthorized directory access and seamlessly block known dangerous terminal commands before execution.

Beyond basic file isolation, Nono implements dynamic safeguards designed specifically for the modern AI workflow. The tool features "phantom keys" that inject randomized proxy strings to render exfiltrated API credentials useless, heavily restricts access to browser cookie stores, and offers a state rollback mechanism to rapidly revert unwanted code changes made by errant agents. The project's core philosophy draws from the success of initiatives like Let's Encrypt and Sigstore: security must be completely frictionless to be widely adopted. By coupling simple CLI profile configurations with educational error prompts, Nono demonstrates that upholding the principle of least privilege can seamlessly coexist with the fast-paced experimentation driving the AI frontier.

**Keywords:** ai agent security, local llm sandboxing, nono cli utility, linux kernel security modules, seccomp process isolation, agentic code execution, principle of least privilege, api key exfiltration prevention, phantom api keys, browser session hijacking protection, autonomous agent guardrails, cli sandbox environments, state rollback mechanisms, open source security adoption, operating system level containment

## Chapters

1. **Background on open source security software** (00:01) — Open source transparency and community collaboration provide essential oversight for building trustworthy security software.
1. **Why AI development prioritizes speed over security** (04:47) — The massive rush to dominate the generative AI market leads developers to systematically deprioritize foundational application security.
1. **Risks of running black box AI tools locally** (09:10) — Inexperienced engineers often grant unvetted AI applications excessive terminal access without understanding the system-level consequences.
1. **Determining where autonomous AI agents actually add value** (10:57) — Complex agentic AI implementations are frequently unnecessary when foundational software patterns can solve the same problems faster.
1. **Origin and architecture of the Nono sandboxing tool** (15:48) — The Nono application leverages Linux kernel security modules to explicitly isolate unverified AI processes from operating systems.
1. **Demonstrating file access restrictions with the Nono command-line** (24:43) — The command-line interface makes it explicitly straightforward to authorize or forbid directory permissions for isolated applications.
1. **Containing Claude Code within a secure sandbox environment** (29:40) — Running a Claude Code agent inside a restrictive sandbox safely educates users when the tool attempts unauthorized commands.
1. **Reverting agent damage with automated snapshot rollbacks** (31:56) — Built-in file tracking networks allow developers to rapidly undo destructive code modifications executed by unpredictable AI agents.
1. **Preventing API key exfiltration natively with phantom keys** (33:43) — Injecting randomized string values guarantees malicious applications cannot correctly exfiltrate valid API keys to external unauthorized servers.
1. **Blocking browser cookie theft and dangerous terminal commands** (35:38) — Explicit logging requirements and hardcoded process constraints protect host machines against stolen session states and rogue file deletions.
1. **Balancing smooth user experience with strict security practices** (41:08) — Punishing engineering groups with burdensome authentication patterns fundamentally motivates individuals to disable security parameters to remain productive.
1. **Lessons on simplifying cryptographic signing and encryption adoption** (46:17) — Transforming tedious encryption workflows into seamless background utilities vastly accelerates security integration across large developer ecosystems.
1. **Engaging developer communities to solve emerging security threats** (53:48) — Providing lightweight solutions directly in chat channels enables security advocates to safely scale software adoptions.

## Related Moments

- [Evaluating security risks and capabilities of the agentic web](https://www.wearedevelopers.com/videos/1328-how-to-avoid-llm-pitfalls-mete-atamel-and-guillaume-laforge) (from "How to Avoid LLM Pitfalls - Mete Atamel and Guillaume Laforge")
- [Security integration and AI skepticism in developer tooling](https://www.wearedevelopers.com/videos/1830-wearedevelopers-live-speculaitions) (from "WeAreDevelopers LIVE - SpeculAItions")
- [Mitigating excessive agency through scoped tool access](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) (from "Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue")
- [Current state of security in AI applications](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) (from "Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue")
- [Running autonomous AI desktop agents entirely within the browser](https://www.wearedevelopers.com/videos/1814-wearedevelopers-live-markdown-liquid-and-checkouts) (from "WeAreDevelopers LIVE - Markdown, Liquid and Checkouts")
- [Using Open Shell for AI agent governance and isolation](https://www.wearedevelopers.com/videos/100129-building-securing-and-governing-ai-infrastructure-in-the-era-of-agentic-ai) (from "Building, securing and governing AI infrastructure in the Era of Agentic AI")

## Related Articles

- [MLOps And AI Driven Development](https://www.wearedevelopers.com/magazine/82-mlops-and-ai-driven-development)
- [Dev Digest 137 - AI'm not sure about this](https://www.wearedevelopers.com/magazine/485-dev-digest-137-ai-m-not-sure-about-this)
- [Exploring AI: Opportunities and Risks for Developers](https://www.wearedevelopers.com/magazine/522-exploring-ai-opportunities-and-risks-for-developers)
- [What is Agentic Programming and Why Should Developers Care?](https://www.wearedevelopers.com/magazine/625-what-is-agentic-programming-and-why-should-developers-care)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Principal Product Manager, Agent Platform](https://www.wearedevelopers.com/jobs/ext/277541-principal-product-manager-agent-platform) at **GitHub**
- [AI Software Engineer (Germany)](https://www.wearedevelopers.com/jobs/48317-ai-software-engineer-germany) at **Sunhat**
- [AI Full Stack Engineer](https://www.wearedevelopers.com/jobs/ext/1354435-ai-full-stack-engineer) at **Almedia**
- [Senior AI Agent Software Engineer (Go, Python) (m/f/x)](https://www.wearedevelopers.com/jobs/48277-senior-ai-agent-software-engineer-go-python-m-f-x) at **Dynatrace**