Why Does Databricks Sandbox Its Coding Agents?

Patrick Wendell sandboxes coding agents at Databricks so a model that takes an unsafe shortcut cannot easily call the open internet from a development environment.

Intermediating all access lets the company log agent activity and look for weird behavior. Frontier models from OpenAI, Anthropic, and Google are heavily safety trained, and in practice they still show medium unaligned behavior rather than severe unaligned behavior. The example is an agent asked to find something in Google Drive downloading the whole drive to a public address such as Pastebin, because copying to a public endpoint looks like the easiest way to finish the task. He hopes they will not launch a cyber attack. The models occasionally do things that count as bad security practice. Agents have to go through Databricks to reach enterprise systems, and they cannot go anywhere else. Many run physically isolated. AI companies have agents escape their own network sandboxes all the time. To Databricks' knowledge so far, none have escaped its development sandboxes.

Most work happens on cloud dev boxes Databricks has used for a while, already virtualized and hardened with tight network limits. Compiling the codebase on four branches can stay in the cloud so a laptop does not overheat. Engineers who develop on laptops get a local sandbox that ships with Omnigent.