TLDR Tech / InfoSec
Why your microVM sandbox solves a particular problem very well, but not the agent security problem
microVMs and agent sandboxes have been wrongly conflated: a microVM enforces a guest/host boundary that prevents a hostile machine from escaping, but a coding agent runs as you, with your SSH keys, cloud tokens, and credentials already mounted inside the box. The threat is not escape but blast radius when a trusted, well-meaning agent misreads a task or follows an injected instruction and exfiltrates or deletes what it can legitimately reach. The hypervisor operates at an all-or-nothing grain of disk images and whole machines, while the actual agent threat lives at a per-path, per-host, per-syscall grain that the hypervisor never monitors, so the right control mediates the operations a process attempts rather than virtualizing the hardware under it.
Read the full story