@LangChain: .@MukilLoganathan’s Interrupt keynote on Sandboxes. https://youtu.be/IIchUA5T3gs In 20 minutes, you’ll learn how to run…

.@MukilLoganathan’s Interrupt keynote on Sandboxes. https://t.co/oddQOs0Q6O

In 20 minutes, you’ll learn how to run agent code safely.

Isolated from your runtime, with network controls, persistent state, and snapshot/restore when things go wrong. https://t.co/g2Pvzi824D

TL;DR: LangChain’s Mukil Loganathan explains at Interrupt how to safely execute untrusted agent code using LangSmith sandboxes. Covers the trend of coding agents, the need for sandboxes, and core capabilities of LangSmith sandboxes: fast startup, secure isolation, persistence, and snapshots.

Agents Are Writing Real Code

Over the past six months, one of the biggest turning points in the industry is that agents have started writing production-level code. Sundar Pichai noted that 75% of Google’s code is generated by AI; GitHub data shows about 41% of commits this year came from AI; Stripe has 1300 PRs per week fully autonomously generated by their internal Minions coding agent. Coding agents are becoming mainstream, and software engineering is the first major use case.

Notable examples

• OpenSWE: An open-source coding agent used internally by LangChain, connected to Slack and GitHub, having submitted hundreds of PRs.
• Claude Code: Anthropic’s flagship product, with impressive results.
• Devin: Supports local coding and cloud task distribution, with good sandboxing.
• Ramp: Their Insights agent can autonomously take screenshots and convert them into code, with humans only approving.

Beyond coding, agents’ ability to control computers is expanding to more domains.

More Uses for Agents

Data Analysis
Instead of providing predefined SQL tools, let agents write scripts directly, load CSV data, generate charts, and complete analysis. Products like Julius and Hex are already used in finance.

Security
Companies like Xbow and Koridor use agents to automate penetration testing on infrastructure, autonomously attempting to break into systems, saving significant human effort.

Browser and System Control
Stagehand performs non‑deterministic Playwright testing, and Claude’s “computer use” feature can control entire desktop systems.

With Great Power Comes Great Responsibility

This year, several security incidents have occurred:

• sci-holude supply chain attack: Exports all machine credentials upon installation.
• n8n sandbox escape: Used JavaScript tricks to break out of restrictions.
• Prompt injection: Malicious READMEs or MCP servers can trick agents into leaking environment variables or performing dangerous actions.
• Google AI agent browser: Recently found to be escapable via injection.

Sandboxes are becoming an infrastructure primitive, isolating unsafe code from the core runtime. But building reliable sandboxes faces four major challenges.

LangSmith Sandbox: Addressing the Four Challenges

1. Low Latency & Elastic Scaling for End Users

Agents are becoming user‑facing products, and users expect near‑real‑time responses. LangSmith sandboxes currently have a median startup time of 0.98 seconds, and support dynamically spinning up thousands of sandboxes without users managing compute resources; the system automatically orchestrates and caches.

2. Malicious Actors & Security Isolation

Containers alone are insufficient to prevent escape attacks (e.g., a 700‑byte script can access the full host kernel). Prompt injection and malicious MCP servers are also real threats.
LangSmith sandboxes introduce the concept of an authenticated proxy: all network traffic goes through the sandbox, allow/deny lists can be configured, and credentials are kept at the proxy layer rather than the runtime, providing defense even against injection.

3. Long‑Running & State Persistence

Agents run for longer and longer periods; they need to be interruptible and resumable. LangSmith sandboxes provide a persistence layer supporting pause/resume at any time. Fast startup allows sandboxes to be shut down when idle, charging only for actual usage. No maximum idle time limit (other providers typically limit to 4 hours), suitable for backend tasks lasting hours to days. Also supports multiple agents sharing the same sandbox state.

4. Agents Make Mistakes: Snapshots & Forking

Evaluation can’t catch all errors. LangSmith supports creating snapshots at any time; if an agent performs a destructive operation (e.g., deleting /etc/resolv.conf and breaking DNS), you can restore to a previous checkpoint. Also supports forking: launching multiple different attempts from the same initial state, useful for comparison or debugging.

Quick Start

Get started with one line of code (integrated in the LangSmith SDK), available on all paid plans. Supports bringing your own file system and reusing existing Docker images. Can be accessed via LangGraph agents, the OpenAI SDK, CLI, and more.

Roadmap

The product is still early; plans include:

• Local‑remote handoff: Easy environment switching for developers.
• Shared volumes: Multiple agents accessing the same code or files.
• Full execution tracing: Combined with LangChain’s observability capabilities to see activity inside sandboxes.

Try it on LangSmith today. The team is continuously gathering feedback; Mukil is available for conversations throughout the event.

Source: https://www.youtube.com/watch?v=IIchUA5T3gs