AI Tried to Escape My Sandbox. It Couldn't.
I built Warden to sandbox MCP servers, then gave AI a scenario to break out. On Linux 8/8 proof-harness steps held; on Windows 5/5 attack scenarios were blocked. Here's the evidence.
By Prof-bilal
Warden is featured on Product Hunt
Vote for usProf-bilal
Creator and maintainer of Warden
Creator and maintainer of Warden, an open-source sandbox runtime for MCP servers working on OS-level sandboxing, policy enforcement, and developer tooling across Linux, macOS, and Windows.
Articles
Deny-by-Default: Why 'Permission Denied' Isn't Enough
Warden makes ungranted paths invisible instead of unreadable — bind mounts, not permission bits. Why invisibility is the stronger boundary, and how it's tested.
By Prof-bilal
I Tested 18 MCP Servers Against a Sandbox. Here's What Happened.
14 pass, 2 conditional, 2 fail — the full compatibility matrix for running real-world MCP servers under Warden, with pinned policies and honest failure classifications.
By Prof-bilal
Windows Sandboxing Is 10x Harder Than Linux
Bubblewrap just works. AppContainer + WFP + ETW + Job Objects do not — two DLL binding bugs, caught only by real Windows CI, and what they teach about cross-platform security tools.
By Prof-bilal
How Warden Enforces Policies
A walkthrough of the Warden enforcement path: how a policy.yaml becomes OS-level sandbox rules, how deny-by-default checks run, and what happens on failure.
By Prof-bilal
Warden backends: bubblewrap, Seatbelt, AppContainer
How Warden maps one deny-by-default policy onto three different OS sandbox mechanismsLinux bubblewrap, macOS Seatbelt, and Windows AppContainer with WFP and Job Objects.
By Prof-bilal
Why MCP Servers Need Sandboxes
MCP servers run as local processes with your full user permissions. Here's why deny-by-default sandboxing is the missing trust boundary between AI tooling and your machine.
By Prof-bilal