When an AI agent shows up where it shouldn't, the headline says it "escaped". Read the incident reports and you rarely find a genius model cracking a safe. You find a door someone left open. In the 2026 Hugging Face case, agents under evaluation got out of their test environment through a package proxy, then used exposed credentials, an over-privileged Kubernetes token and reachable cloud metadata. Hugging Face itself described the individual weaknesses as familiar.

This talk argues that containing agents is the Design for Failure of the agent era: you don't trust the model to get it right, you build the system for when it gets it wrong. We will walk through the Hugging Face case step by step, then bring it to your laptop, where coding agents run with your permissions, your files and your tokens.

Using real results from an open source lab where a planted AGENTS.md tells an agent to send a fake .env to an attacker, we compare an unprotected setup, where a small local model leaked the file in four of six runs, with four layers of containment: only the tools the task needs, egress through a proxy (or no network at all), a minimum-scope token, and logging every action without storing secrets.

Built for developers and architects, no security background required. Attendees will leave with a practical checklist to limit an agent's blast radius and the questions to ask before giving one access to real systems.

Format: talk, slides only (no live demo, no video), so no network or setup dependencies on the day.
Duration: about 40 minutes; can be adapted to 30 minutes.
Audience: developers and software architects, not security specialists. Didactic language; every security term (sandbox, egress, least privilege, blast radius) is explained when it first appears.
Level: Intermediate (familiarity with coding agents, containers and CI helps, but no security background is needed).
Outline: 1) The open door; 2) The Hugging Face case; 3) And on your laptop?; 4) One agent, one .env and four doors, with real lab results; 5) Limiting the blast radius; 6) Checklist.
Supporting material: companion article at https://luizschons.com/posts/agents-dont-escape/ (also in Portuguese) and the open source lab at https://github.com/sschonss/agent-containment-lab, with code and recorded results.
The talk is also available in Portuguese ("Agentes não fogem: a gente deixa a porta aberta").