用事务式沙箱让AI编程代理安全自主运行，零失败回滚且性能损耗仅14.5%。
Fault-Tolerant Sandboxing for AI Coding Agents: A Transactional Approach to Safe Autonomous Execution
- 通过原子事务封装代理操作，实现安全执行与状态自动回滚。
- 高危指令拦截率和失败状态恢复率均为100%，每事务延迟约1.8秒。
- 适合构建无交互、可长期运行的自主AI编程系统。
大型语言模型（LLMs）从被动代码生成转向自主代理，带来破坏性命令与系统状态不一致等安全风险。现有商业方案多侧重交互式用户安全，强制认证流程阻碍了无头自主运行。本文提出一种容错沙箱框架，基于策略拦截层与事务式文件系统快照机制，假设将代理行为包裹在原子事务中可兼顾安全性与低延迟，优于容器初始化开销或商业CLI的交互摩擦。我们在自建的Proxmox测试平台部署Minimind-MoE LLM（通过nano-vllm服务），采用EVPN/VXLAN隔离。实验表明，高风险命令拦截率达100%，失败状态恢复率100%；原型每事务性能开销仅14.5%（约1.8秒）。相较之下，Gemini CLI沙箱需交互式登录，无法用于无头自主工作流。
原文摘要 · Abstract (English)
The transition of Large Language Models (LLMs) from passive code generators to autonomous agents introduces significant safety risks, specifically regarding destructive commands and inconsistent system states. Existing commercial solutions often prioritize interactive user safety, enforcing authentication barriers that break the headless loops required for true autonomy. This paper presents a Fault-Tolerant Sandboxing framework designed to mitigate these risks through a policy-based interception layer and a transactional filesystem snapshot mechanism. We hypothesize that wrapping agent actions in atomic transactions can guarantee safety with acceptable latency, outperforming the heavy initialization overhead of containers or the interactive friction of commercial CLIs. We validated this approach by deploying the Minimind-MoE LLM served via nano-vllm on a custom Proxmox-based testbed utilizing EVPN/VXLAN isolation. Experimental results demonstrate a 100\% interception rate for high-risk commands and a 100\% success rate in rolling back failed states. Crucially, our prototype incurs only a 14.5\% performance overhead (approx. 1.8s) per transaction. In contrast, benchmarking against the Gemini CLI sandbox revealed that it requires interactive authentication ("Sign in"), rendering it unusable for headless, autonomous agent workflows.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。