AI agents in AI startups – securing production tasks

01Why a sealed microVM matters for customer‑facing agents

Agents that ship code to customers or run per‑user tasks are executed on the same host that holds production data. A shared kernel gives the agent a direct path to the host OS and any other tenant, turning a harmless typo into a privilege‑escalation vector. A sealed microVM isolates the kernel, giving each agent its own execution surface that cannot see the host beyond a single workspace directory.

When the microVM is sealed, the only visible path is the workspace folder you mount. All other host resources are invisible, so an agent that tries to read /etc/passwd or enumerate other containers fails instantly. This isolation is the single most effective safeguard for SOC 2 and ISO 27001 requirements around logical separation.

02Typical agent workloads and plausible failure modes

A code‑executing assistant that writes data‑pipeline scripts, a per‑user task runner that pulls third‑party APIs, and an evaluation harness that benchmarks new models are common in AI startups. Each of these workloads needs fast start‑up, access to a few secrets and the ability to spin many parallel attempts.

Imagine the pipeline assistant mistakenly receives a malformed request that includes a shell‑escape payload. The payload runs inside the agent’s process and tries to escape to the host file system. Because the agent runs inside a sealed microVM, the escape attempt stops at the VM boundary and the host remains untouched.

Suppose the task runner fetches an API key from a configuration file that lives on the host. The key never enters the sandbox; the egress broker injects it only on outbound traffic, so the agent never stores the real credential. A rogue agent that logs its environment therefore only sees a placeholder, not the secret.

03Control sets that satisfy SOC 2 and ISO 27001 without burning runway

The first control is a dedicated sealed microVM per customer task. This provides logical separation, a requirement of SOC 2’s logical access controls and ISO 27001’s asset management. The microVM also gives you a clean image for each task, eliminating drift.

Second, use checkpoints before any risky operation. A checkpoint saves the whole running machine in about 0.7 seconds, and a rewind restores it in about half a second. This lets you test a risky library upgrade, rollback instantly on failure, and keep the agent’s state for forensic analysis.

Third, enforce a network allow‑list. By default the network is closed; you explicitly add outbound hosts such as api.anthropic.com. This satisfies the “restrict inbound and outbound traffic” control and prevents an agent from exfiltrating data to an unknown endpoint.

• Use the two‑person rule for actions that would expose real production secrets.
• Export the hash‑chained audit log with kosa8 evidence export for questionnaire evidence.

04How kosa8 builds the evidence chain your enterprise questionnaire expects

Every action inside a sealed VM is written to a hash‑chained, tamper‑evident audit log that marks whether the actor was human or agent. The log can be verified at any time with kosa8 audit verify, giving you immutable proof that a privileged command was only run after the required approvals.

When auditors request proof of network controls, you can show the allow‑list configuration used to start the sandbox. When they ask for key‑handling procedures, the egress broker model demonstrates that no real API keys ever reside inside the sandbox, only placeholders.

All of this evidence can be exported in a single step, satisfying the “provide documented evidence for security controls” clause that appears in most enterprise security questionnaires.

05First‑day checklist for the CISO

Create a sealed sandbox for the first agent with an explicit allow‑list for the production API endpoints you need. Verify the workspace mount points with kosa8 daemon start --allow-mount and keep them read‑only unless a write is required.

Take a checkpoint before the agent runs any code that touches external services. Label the checkpoint clearly, then run the agent. If the run produces an unexpected alert, rewind instantly and investigate the audit log.

Configure the two‑person rule for any command that would contact a real secret. Record the approval in the audit log and ensure the log is exported weekly for compliance review.