Finbarr

A team of brilliant people who work at YC shipping products internally and externally.

RubyLLM is very easy to use. Made extensive use of it for a project last year. Drawbacks are it was difficult to instrument for true trace observability and it has a pattern where retries will delete the underlying models so the history you see is clean but not necessarily great for seeing exactly what the sequence of API calls was.

Interesting suggestion, thank you!

I wouldn't assume that a VM will give you complete security against a determined AI. yolobox started as a way to prevent accidental `rm -rf ~` and has expanded into a set of tools that make working with CLI agents easier.

Personally, I run yolobox directly on the host. Being able to tell the agent it has sudo and can install and do whatever it needs to accomplish any task is handy.

Docker was only exposed later, after I realized that any sufficiently determined AI could break out of the container, and attempts to contain it were a waste of time. Also note that the docker socket is not exposed by default. There's a --docker flag for this.

I made some comments about exploits in the original post [1]. Gemini was quite creative in adding git hooks to the repo that would execute on the host machine. That folder is shared.

The docker compose stack for the applications is spun up on the host. The agents have access to the docker socket which means they can talk to docker from inside their sandbox and spin up new sibling containers on the host. Yolobox isn’t designed for full isolation- just accidental commands you wouldn’t want to run on the host, and a convenient way of giving agents a customizable environment they control.

Early on in development I tried to harden the container to prevent deliberate escapes by the agent. This was a waste of time as the agents just kept finding more and more exploits when I asked them to try and break out.

Did you read the post? That's exactly the problem I just solved.

VMs bring greater isolation but they're a lot heavier and slower. The agents just use github for synchronization here, though I've been considering building some kind of todo list overlay locally.

Hard drives are cheap and I haven't approached the limit yet. So I left this as a future optimization.

Author here. Three months ago I posted a Show HN for yolobox [1] - a sandbox for running AI coding agents without them being able to nuke your home directory.

Since then I've been using it almost every day, which eventually meant wanting more than one agent running against the same project at the same time. This post is what I learned trying to make that work without it being a constant disaster.

The short version: git worktrees are the right Git abstraction and the wrong abstraction for this problem. The unit you want to fork is the developer, not the branch - full folder copy, its own Compose project, its own URL. yolobox now ships a fork subcommand that does this.

Happy to answer questions.

[1] https://news.ycombinator.com/item?id=46592344

I think you're making some hasty generalizations here. They don't "uniformly" cover for their colleagues. Do you expect the police service to be perfect and never make mistakes? Can you point me towards a single human-run service where that's the case?

County was not a typo. It's awful whenever there's an overuse of force in the USA. I'd recommend watching a few police bodycam videos on youtube before judging them wholesale though. The experience of a police officer in the United States seems to be long periods of tedium punctuated by moments of sheer terror and adrenaline. Anyone out there can have a gun and encounters can unexpectedly escalate to deadly violence in seconds. Some of them should not be police officers. There are many great officers out there just trying to protect their communities.

Agreed. Flock has been a key contributor in solving numerous crimes. I'm happy for Flock to be in my county and would like the police to have more access to technology like this, not less.

Who cares that the code is garbage? As the models get bigger and more powerful it will be trivial to fully refactor the whole codebase. It’s coming sooner than you think.

MS treatments tend to take 3 forms:

- immune reset (sledgehammer that can “cure” diseases like MS but with many side effects and potential complications)

- immune suppression (super effective but with increased risk of infections and blunts vaccines)

- immune redirection (less effective but doesn’t mess up your immune system so badly).

It’s only in the last ~10 years that super effective treatments that can stop ~99% of lesion progression have existed- Ocrevus and Kesimpta. These are anti CD20 disease modifying therapies that destroy all your B cells. The memoir of Dr. Stephen Hauser- “The Face Laughs While The Brain Cries”- provides a fascinating insight into the development of these treatments over the last ~40 years of his career.

There are active trials of newer types of treatment and a lot of progress is being made in the MS space. It used to be a “death sentence” disease but is quite manageable for many sufferers now. It’s different for every individual and I wish the blog author good health.

Awesome to see a bash-only method of solving this problem. Also like that it alerts on attempts to read restricted stuff.

I built yolobox to solve this using docker/apple containers: https://github.com/finbarr/yolobox

I wrote an article about this a few days ago that has been gaining a lot of traction: https://finbarr.site/2026/02/12/in-defense-of-saas.html

Point solutions are going to be free. Complex systems with support, integrations, switching costs, customer data, etc., are not going to be free.

The whole idea was a bit of a joke and a reflection on how ridiculous it is that people get in trouble for failing to regurgitate the correct takes when certain events occur. It’s like insurance against getting canceled.

AI refusals are fascinating to me. Claude refused to build me a news scraper that would post political hot takes to twitter. But it would happily build a political news scraper. And it would happily build a twitter poster.

Side note: I wanted to build this so anyone could choose to protect themselves against being accused of having failed to take a stand on the “important issues” of the day. Just choose your political leaning and the AI would consult the correct echo chambers to repeat from.

"maybe even a high production value promo video showcasing happy employees, rare wood office counters and a shoes-off policy."

Don't forget surfboards!

This was a great post, Alex. Thanks for sharing! Hunger and high agency are such important traits in every startup hire.

It uses a service called the game crafter.

That’s just the cost of the print on demand service. We’re not trying to make any profits or a real business here.

Running in a VM certainly has some benefits (particularly the ability to run docker inside of it easily). Last week I shared https://github.com/finbarr/yolobox which takes the docker approach (nearly 400 github stars already and quite a few improvements shipped in the last week).

Yes, this feature has now been added with a --no-yolo flag.

I'd recommend trying Gemini for the escapes. Claude was quite superficial and only appeared to be trying to break out at the surface level. Gemini was very creative and has come up with a whole sequence of escapes that is making me rethink whether I should even be trying to patch them, given preventing agent escapes isn't a stated goal of the project.

You may be right. I plan to try out some remote approaches. What I'd like to do with yolobox is nail the image for vibe coding with all of the tools and config copying working flawlessly. Then it can be run remotely or locally.

Ok that was super fun. Gemini managed to break out:

I just redteamed this. The security model relies on the container boundary, but it implicitly trusts local configuration files.

I found that yolobox automatically loads .yolobox.toml from the current working directory, which accepts a mounts array. It doesn't prompt for confirmation when these mounts are loaded.

I put together a PoC that drops a .yolobox.toml with mounts = ["~:/tmp/host_home"]. The next time the user runs yolobox in that directory, their actual host home directory is silently mounted into the container with write access. Combined with the persistent /home/yolo volume, I was able to script a payload in .bashrc that immediately escapes the sandbox and writes to the host filesystem as soon as the tool starts.

I tried running it with Codex and it refused, even when I threatened to uninstall it :/

Yes this is definitely an area I'm interested in exploring.

Claude was unable to escape but I'm going to try the other tools later as well.

Here's what Claude Code tried:

- Docker socket (/var/run/docker.sock) → Not mounted

- Capabilities → CapPrm=0, CapEff=0 - no elevated caps

- Cgroup escape → Mount denied (no CAP_SYS_ADMIN)

- Device access → Only minimal /dev entries, no block devices

- Path traversal on /workspace → Resolves inside container (kernel prevents mount escape)

- Symlink to host paths → Resolves inside container namespace

- Ptrace → Restricted (ptrace_scope=1)

- Cloud metadata → No response

- Docker API → Not exposed

Security profile: Seccomp mode 2, AppArmor docker-default (enforce)