Baseten CTO Amir Haghighat points out a critical gap in AI agent security that even major labs haven't solved: sandboxing can isolate execution environments, but there's no way to guarantee what an agent actually does inside that sandbox.
The core problem: You can containerize the runtime, but you can't predict or control the agent's internal logic once it starts executing. Traditional security models assume deterministic behavior, but agents are inherently non-deterministic.
Baseten's approach: Zero data retention by design. They're betting that if you can't log or persist what happens inside the sandbox, you reduce the attack surface for data exfiltration, but this doesn't solve the fundamental observability problem.
This is the AI security paradox: The more autonomous the agent, the less you can verify its behavior without breaking the autonomy that makes it useful. Big labs are still figuring out how to build guardrails that don't cripple functionality.
The core problem: You can containerize the runtime, but you can't predict or control the agent's internal logic once it starts executing. Traditional security models assume deterministic behavior, but agents are inherently non-deterministic.
Baseten's approach: Zero data retention by design. They're betting that if you can't log or persist what happens inside the sandbox, you reduce the attack surface for data exfiltration, but this doesn't solve the fundamental observability problem.
This is the AI security paradox: The more autonomous the agent, the less you can verify its behavior without breaking the autonomy that makes it useful. Big labs are still figuring out how to build guardrails that don't cripple functionality.