What does it take to secure AI agents without slowing developers down? A recent panel explored the answer
I recently joined Zach Lloyd, founder and CEO of Warp; Gavriel Cohen, co-founder and CEO of NanoCo and creator of NanoClaw; and moderator Moriah Hara, founder of a community of more than 3,000 CISOs and a three-time Fortune 500 CISO, for a discussion on one of the biggest challenges facing enterprise security teams today: how to safely unlock the productivity of agentic AI.
The rapid rise of agentic AI in the enterprise is putting CISOs in a tough spot. On one hand, business leaders are clamoring to run with the new technology, which promises a productivity revolution like no other. On the other, setting AI agents loose without rigorous guardrails creates severe vulnerabilities.
Moriah put the dilemma facing CISOs like this: “The business wants AI agents everywhere, developers are already using them, sometimes without approval, oftentimes without security.
…CISOs are left in this uncomfortable middle where we’re tolerating some tools, we’re praying that nothing breaks, we’re buying some time until we can get some governance beyond policy in place to have better visibility.”
The panel explored the role of the CISO in balancing this tension between productivity and security. Here are some highlights.
Isolate, control, observe
They came at it from different angles, but the panelists agreed on one imperative: running AI agents safely requires an isolated environment with trusted control boundaries. For Zach, Warp’s Oz platform provides that isolation. It’s a cloud agent infrastructure for secure and automated deployment of coding agents that allows centralized management, access controls, and visibility into what agents are doing across the organization.
Zach said you can “literally pull up the Oz web app and see what every agent across your company is doing at all times—which is a way better situation than the world we’re in right now, where someone on your marketing team is running Cloud Code, someone on your sales team is running Codex, and you just have no idea what’s going on, what tools they’re installing.”
NanoClaw—a personal AI agent
At Docker, our answer to the challenge of running AI agents safely is to run them in disposable, isolated, local sandboxes. Docker Sandboxes give agents the freedom and autonomy they need to do their best work, safely. Call it YOLO mode with guardrails. As Moriah noted in our discussion, agentic speed should be encouraged— “it’s the ungoverned speed that is the problem.” When agents are allowed to run fast without running wild, speed and safety are no longer a tradeoff.
Of note here: In March, we announced the integration of NanoClaw with Docker Sandboxes to deliver secure-by-design agent execution. The integration allows every NanoClaw agent to run inside a disposable, MicroVM-based Docker Sandbox that enforces strong operating system-level isolation. The stack takes advantage of NanoClaw’s minimal attack surface and fully auditable open-source codebase to meet enterprise security standards.
Laptops as the new prod
A key focus of the discussion was where to run agents safely. With vibe coding exploding, and agents and Claws (a new class of agents) already in production, the laptop today is the most powerful node in the enterprise. It’s also the most exposed. As a colleague of mine recently put it, laptop and agent environments are the new prod, and they need to be governed like prod.
Zach stressed the need to get agents off people’s laptops and desktops and into a controlled, cloud-based environment where CISOs can see what every agent across the company is doing at all times.
Portability—from laptop to cloud
My position is that, if you run agents in a sandbox, it doesn’t matter where the box sits. It could sit on a marketing or finance person’s laptop, or on a DevOps engineer or cloud admin’s machine. As long as the trust boundary is established and you know what’s getting piped in and out of it, you’re locked and loaded for rapid prototyping, experimentation, and innovation.
By the way, this view syncs with Docker’s vision, which has always been about portability. Our vision was never everything is local. We start in the local environment, then lift off into distributed environments, Kubernetes clusters, public clouds, whatever. It’s the same with agents. Eventually they’ll lift off, be decoupled from human operators, and be able to run fully autonomously wherever needed—always in the same portable environment.
When agents build the supply chain
The supply chain today is a revolving door for opportunistic attackers like TeamPCP and ShinyHunters who exploit transient dependencies and other vulnerabilities, often needing only a short window of time to filch credentials and information.
How are CISOs to combat these risks when AI agents themselves are pulling base images, choosing dependencies, and assembling code—autonomously and without human oversight? After all, in an autonomous supply chain, traditional methods of scanning and patching after building are no longer feasible.
Keeping humans in the loop
The panelists shared several best practices. Zach urged keeping humans in the loop for picking clean, secure dependencies, especially upstream libraries, and setting up blessed images for agents to choose from. Gavriel recommended setting a minimum release age of seven days for images and minimizing dependencies—even safe ones.
A training-wheels approach
Gavriel also suggested a training-wheels approach to experimenting with agents, starting out using unpermissioned data to build skills and avoid sensitive data issues. “Unlocking the value today is important,” he said, “but even more important is having people build the skills of working with agents, because what’s going to be coming in the coming months and years is going to totally exceed anything that we have today. So, it’s really about building the muscle memory, building the skills.”
Layer security to limit the blast radius
My take? Opportunistic attackers are simply exploiting an ecosystem that’s inherently flawed and broken and that unfortunately won’t get fixed within the next six to 12 months. Until then, developers should assume these attacks will continue and prepare for them by layering security to limit the blast radius. That means reducing privilege, reducing third-party access to their environment, and using immutable tags, digests, and SBOMs (Software Bill of Materials) to lock manifests and enable rapid detection of poisoned images. And, yes, outsourcing the risk to a trusted build environment like Docker that provides clean, hardened images so you’re starting from a clean foundation.
MCP—the new shadow IT?
The panelists rounded out the discussion with a focus on the security implications of using MCP in developer environments. MCP (Model Context Protocol) is a standard that allows LLMs to access external data and use tools, potentially making AI more powerful and reliable.
The consensus was that centralized, secure governance is crucial for productivity and risk management. Gavriel stressed the importance of proper version control, credential management, and a “golden repository” of verified tools. Zach advocated for centralized management to avoid individual tool dependencies and ensure minimal access.
Making it safe and easy to run MCP servers
And Docker? About a year ago, we introduced an open source MCP Gateway that serves as a chokepoint between agents and external tools. Routing every tool call through this enforcement point, where it can be authenticated, authorized, and logged before it reaches the external system, enables a wide range of agents to access trusted catalogs of MCP servers. While it’s not clear to me how long MCPs will remain useful, given the exponential speed with which AI is evolving, Docker MCP Gateway solves an important challenge today. Like Docker Sandboxes, it makes enforcement strict instead of advisory.
A once-in-a-generation opportunity—and challenge
Enabling dev environments to take advantage of agentic AI is a once-in-a-generation opportunity, and CISOs are accountable for making sure the rush to do so doesn’t devolve into the Wild West.
Moriah closed the panel with a provocative thought: “Six months from now, enterprises are all going to be running agents at scale. The one key success factor will be whether governance was present from day one or got bolted on after the first major incident.”
In the choose-your-own-adventure reality of agentic AI today, what kind of security leader will you be?
Facts Only
* A panel discussed securing the productivity of agentic AI in the enterprise.
* Business leaders desire AI agents for productivity, while deploying them without security creates vulnerabilities.
* CISOs face a dilemma balancing productivity demands and security requirements for AI agents.
* A core imperative for safe deployment is running AI agents in isolated environments with trusted control boundaries.
* Warp’s Oz platform provides cloud agent infrastructure for centralized management and visibility.
* NanoClaw operates in disposable, local sandboxes, such as Docker Sandboxes, to provide safe execution.
* The integration of NanoClaw with Docker Sandboxes enforces operating system-level isolation.
* Laptops and agent environments are identified as the new production nodes requiring governance.
* Portability suggests that sandbox security is independent of the physical location of the agent execution environment.
* Security in the supply chain requires keeping humans in the loop for dependency selection and image blessing.
* A training-wheels approach is suggested for building user skills with agents using unpermissioned data initially.
* Layering security by reducing privilege, limiting third-party access, and using immutable tags/SBOMs is recommended to limit blast radius.
* The Docker MCP Gateway acts as a chokepoint to authenticate and log tool calls from agents to external systems.
Executive Summary
The enterprise faces a tension between the business desire to rapidly adopt agentic AI for productivity gains and the security imperative to maintain rigorous controls, as unchecked deployment creates significant vulnerabilities. CISO roles are currently situated in an uncomfortable position, balancing innovation with risk management amidst existing use of AI tools by developers often without proper oversight. The panelists converged on the necessity of implementing a framework based on isolation, control, and observation for safe agent execution.
A core proposed technical solution involves running agents within isolated environments, such as Docker Sandboxes, to provide necessary autonomy while enforcing strict operating system-level isolation. This approach suggests that speed and safety are not mutually exclusive when agents operate within controlled boundaries. Furthermore, the discussion highlighted that the laptop environment is increasingly acting as the primary production node for agents and must be governed similarly to production systems. The consensus points toward establishing centralized governance, requiring controls over agent execution, dependency management (like secure base images), and access to external tools via enforcement gateways.
The broader implications suggest a shift in security strategy from post-build scanning to securing the execution environment itself. This requires addressing risks throughout the development lifecycle, from managing dependencies to governing model context protocols. Successful integration hinges on establishing strong trust boundaries around agents, ensuring traceability of autonomous actions, and fostering developer skills alongside technical safeguards to manage the evolving supply chain of AI-driven code.
Full Take
The discussion reveals an underlying tension between the acceleration of AI capabilities and the established, slower mechanisms for enterprise risk management. The shift demanded is not simply adding more security layers but fundamentally re-architecting how autonomy interacts with control. The pattern observed is a move from perimeter defense to deep, contextual runtime enforcement, moving security accountability from the artifact (the built code) to the execution flow itself.
The emphasis on sandboxing and immutable artifacts reflects an understanding that traditional static security scanning is insufficient against autonomous supply chain risks; the focus must shift to enforcing constraints at the point of action. The suggestion that the laptop is the new production environment points toward recognizing that physical location is secondary to establishing a verifiable trust boundary, which supports the portability argument. This challenges the notion that control must be centralized in a single cloud; instead, decentralized, verifiable isolation can achieve enterprise-wide governance across distributed endpoints.
The advice regarding human skill-building and dependency management addresses the systemic issue of developer adoption: pushing for speed without competence compounds risk exponentially. The integration of protocols like MCP gateways into execution flows demonstrates that governance must be embedded architecturally, not bolted on retrospectively. The core implication is that successful navigation of agentic AI requires acknowledging that the threat landscape evolves faster than policy can be implemented, necessitating an infrastructure designed for inherent, verifiable security rather than merely compliance checking. What is missing is a unified framework specifying how this architectural principle—isolated portability with enforced runtime logging—should map to existing CISO responsibilities across disparate organizational units.
Sentinel — Human
The text appears to be a summary of an expert panel discussion, characterized by specific technical terminology and a conversational yet structured presentation of risk management principles.