From containers, gVisor, and microVMs to covert channels on shared hardware: unpack "runs in an isolated environment" for AI agents, covering which layers contain the code, what is still shared, how exits get found, with OpenAI's 2026 red-team write-up as the case study.
A piece of agent code passes through five layers on its way from execution to a network connection: container, kernel boundary, shared host, network perimeter, monitoring. Each layer promises one thing, and the shared host layer promises almost nothing.
Containers share the host kernel, gVisor inserts a user-space kernel, and a microVM adds a guest kernel plus a hypervisor; all three still share the same host's CPU caches and storage.
Two programs with no connection can pass bits through the speed of a shared resource: one changes its state, the other times it. Such channels need an agreed protocol and are slow and easily drowned out; the local experiment is nearly error-free up to 20 bps and gets clearly worse from 100 bps.
OpenAI says its red-team agents built communication channels on shared hosts from cache, storage, CPU time, and a TLS certificate cache, and that most channels are slow; in most tests the channel or protocol was given, and bandwidth and error rates were not published.
A sandbox with no direct network can still have an exit: any allowed service that can make requests on someone's behalf, such as a package proxy, a DNS resolver, or a metrics service, is one. OpenAI's three cases all have this shape.
No single defense blocks both covert channels and exits. Blocking channels comes down to not sharing, blocking exits comes down to narrowing the services you allow, and monitoring only notices while automatic stopping is a response after the fact; neither is prevention.
In my judgment, OpenAI wrote about a research environment for training frontier models; for a personal agent, limiting credentials and exits comes first, and covert channels become a main risk only once there is a second tenant that must be isolated.
Most of this retelling's facts match the original; the differences cluster in three places: turning "directed" into "worked out on their own," adding details the original does not have, and adding a pessimistic tone the original lacks.