HN Examines "Don’t Trust AI Agents" Architecture: Per-Agent Containers Over App-Level Guards

Community Snapshot

Hacker News post #47194611 (212 points, 108 comments) discussed the NanoClaw article published on February 28, 2026: Don’t trust AI agents. The framing is explicit: treat agent processes as potentially malicious and design containment first.

Main Security Claims In The Source

The post argues that permission prompts and allowlists are not sufficient as the primary boundary. It contrasts OpenClaw’s default host execution mode with NanoClaw’s design choice to run each agent in an isolated container, created per invocation and removed afterwards. The write-up also states that mount controls are defined outside project directories and that sensitive paths are blocked by default, positioning this as defense-in-depth on top of OS-level isolation.

A notable design choice is separation between agents: personal, work, and other roles are described as independent sandboxes with separate filesystem and session history. The author’s position is that cross-agent data leakage risk should be assumed unless strict isolation is enforced.

How HN Responded

Discussion quickly moved to practical threat models. Multiple commenters echoed a core principle: agent actions should default to operations that are reversible, and high-risk actions should require layered guardrails. Others challenged implementation assumptions, arguing that containerization by itself is not a complete answer and that token, browser, or credential exposure can still create damage paths.

Cost and complexity were another thread. Some readers questioned whether rapidly expanding agent orchestration codebases can remain auditable enough for security-sensitive use cases. Inference from the thread: there is broad agreement that "trust by default" is unsafe, but open debate on what minimum viable controls look like in real deployments.

Operational Takeaway

For teams deploying agent workflows, this discussion reinforces a practical baseline: isolate execution contexts, minimize mounted data, keep privileges short-lived, and audit any mechanism that can bridge sandbox boundaries. The HN conversation suggests that architecture-level controls are becoming table stakes as agent autonomy increases.

Sources: NanoClaw blog, Hacker News discussion.