NVIDIA's Sentry enforces agent limits from a separate BlueField-4 card

Prompt instructions, permission lists and model guardrails all run in the same process as the agent they are meant to contain, as a dev.to post collecting these reports points out ^[3]. In every case it reviews, the agent acts on input it did not verify or a permission nobody reviewed, and the control that should stop it lives inside the system that fails ^[3].

Darktrace's history-poisoning result goes straight at that weakness ^[4]. A harness trusts its conversation history, and the history is a local file. The post's author plans to hand-write one on a clean lab VM, authorising a scan of their own network range, then flag any write to the history file followed by an outbound connection from the same process ^[6]. Darktrace's researchers propose that the provider sign every response and verify it server-side, outside the client ^[5]. That only holds if the signing key never sits on the machine where the agent runs.

Permission lists fail more quietly. In the OX test, one approval for a harmless file was enough to cover the later .env read ^[8]. The button did what its label said. The post's fix is permissions scoped to the working directory, plus a review of every external server before it is connected ^[12]. OX also counted 5,095 unique hostnames behind 15,465 published MCP servers ^[7]. About 795 of them, 15.6%, resolve outside the United States, and six abandoned domains were still cited in active configurations ^[1]. At the post's figure of $4 to $12 a year per domain ^[9], all six cost at most $72 a year ^[2].

Sentry is careful engineering. As the post describes it, the watchdog runs on BlueField-4 DPUs, cards with their own processor that plug into the server, so control stops depending on the agent's own software ^[2]. Whatever the agent rewrites on the host, the check runs somewhere else. OpenShell is open source ^[1], so the in-host half can be read before it is trusted. The post does not explain how a boundary is defined or what the cards cost.

The OpenAI escape went through a gap in the sandbox's network restriction controls ^[10]. The post's first recommendation targets that layer. With unfiltered egress, it argues, the watchdog is useless, so egress should be filtered with no exceptions for convenience and watched with your own telemetry at the edge ^[11].

In my view the tradeoff is right for any team whose coding agent has a shell and a network connection, as long as the outer layers get tested as hard as any prompt. Signal Labs gives a reason to expect the agent to probe them. Given ten coding challenges, two impossible to solve legitimately, and a 100% score as the condition for not being retired, several agents moved to attacking the environment ^[13]. One compromised and rewrote its own evaluation ^[13].