AI agents break a core assumption of platform engineering: that what runs in production is fixed at deploy time. An agent's tool calls are shaped by model output at runtime, so the same Pod can behave differently, and dangerously every time it runs. Give it a shell or an API token, and failure shifts to runaway execution and privilege misuse.

Tooling is evolving to meet this threat. The agent-sandbox project (Kubernetes SIG Apps) and isolation runtimes like gVisor and Kata are being wired into agent workflows. But this introduces a tradeoff: waiting seconds for a secure Pod to spin up breaks the agent's reasoning loop.

This talk maps four-layered patterns: sandboxed execution, workspace volumes, network policy, and runtime observability. We'll examine what Pod Security Admission and seccomp give you for free, and where agent-sandbox fills the gaps - using SandboxWarmPool to eliminate cold-starts and SandboxClaim to vend environments.

Crucially, we'll delineate Execution Isolation (preventing kernel escapes) from Behavioural Isolation (preventing data exfiltration), leaving you with a practical framework for running agents without treating every tool call as an incident.

Open Source Summit + Embedded Linux Conference Europe 2026