Security leaders have spent two years caught between a board that wants AI agents everywhere and an attack surface that grows every time a developer pastes an API key into one. A panel discussion published by Docker on July 25, 2026 — featuring Moriah Hara, a three-time Fortune 500 CISO who runs a community of more than 3,000 security chiefs — puts unusually candid language on that squeeze, and lays out the clearest version yet of the doctrine now consolidating across the industry: agents get freedom inside enforced boundaries, or they don’t run at all, per the Docker blog post.
The Uncomfortable Middle
Hara’s description of the current enterprise reality deserves quoting in full, because it matches what most security teams privately admit: “The business wants AI agents everywhere, developers are already using them, sometimes without approval, oftentimes without security. …CISOs are left in this uncomfortable middle where we’re tolerating some tools, we’re praying that nothing breaks, we’re buying some time until we can get some governance beyond policy in place,” she said in the panel discussion.
The important phrase is governance beyond policy. Written acceptable-use policies do nothing against an agent that autonomously installs dependencies, calls external tools, and executes shell commands faster than any human can review. What the panelists converged on instead is architectural: an isolated execution environment with trusted control boundaries, summarized as isolate, control, observe.
Isolation: Disposable Sandboxes Instead of Trust
Docker’s own answer is to run agents in disposable, isolated, local sandboxes — what the post cheerfully calls “YOLO mode with guardrails.” Docker Sandboxes give each agent a MicroVM-based environment that enforces operating-system-level isolation, so an agent can be granted broad autonomy inside the box while the blast radius stays contained, per the announcement and the Docker Sandboxes documentation. Docker notes that since March, its NanoClaw integration has run every NanoClaw agent inside one of these disposable MicroVM sandboxes, pairing a minimal attack surface with a fully auditable open-source codebase.
The panel framed the underlying principle memorably: agentic speed is not the problem. “It’s the ungoverned speed that is the problem,” as Hara put it. Sandboxing is what converts that trade-off from a dial (slower = safer) into an architecture (fast and bounded).
There was one genuine disagreement worth noting. Zach of Warp argued for pulling agents off laptops entirely and into centrally managed cloud infrastructure, where a security team can “see what every agent across your company is doing at all times.” Docker’s position is that if the sandbox boundary is trustworthy, location stops mattering — the same sealed box can run on a marketing laptop or in a Kubernetes cluster. That difference — centralize the runtime versus centralize the trust boundary — is likely to define competing products in this space for the next year.
Laptops Are the New Prod
Either way, the panel agreed on the diagnosis behind the argument: with vibe coding exploding and agents already doing real work, the ordinary developer laptop is now “the most powerful node in the enterprise” — and the most exposed. Agent environments hold live credentials, production access and autonomous execution, which means they need to be governed like production infrastructure, not like end-user devices, per the discussion.
That reframing has teeth. Production systems get change control, audit logs, least privilege and hardened images. Almost no organization applies any of that to the machine where an engineer runs a coding agent with push access to the repo.
When Agents Assemble Their Own Supply Chain
The sharpest section of the discussion concerns software supply chain risk. AI agents now pull base images, choose dependencies and assemble code autonomously — which breaks the traditional scan-and-patch-after-build security model outright. Meanwhile opportunistic groups like TeamPCP and ShinyHunters exploit transient dependencies, often needing only a short window to steal credentials, per the Docker post.
The panelists’ countermeasures are notably concrete:
- Keep humans in the loop for selecting upstream libraries, and give agents curated sets of blessed, pre-approved images to choose from rather than the open registry.
- Impose a minimum release age — one panelist recommended seven days for images — so agents never install a package the moment it (or a poisoned version of it) ships. GitHub’s Dependabot arrived at the same conclusion this week with its new default update cooldown, a convergence that suggests release-age delays are becoming standard supply-chain hygiene.
- Layer defenses to limit blast radius: reduce privilege, restrict third-party access, and pin manifests with immutable tags, digests and SBOMs so poisoned images can be detected and traced quickly.
MCP: The New Shadow IT
The Model Context Protocol — the standard that lets LLMs call external tools — got the panel’s most pointed warning label: unmanaged MCP servers are shaping up to be this cycle’s shadow IT. Every developer wiring an unvetted MCP server into an agent is granting tool access outside any credential-management or version-control regime.
The consensus fix mirrors the sandbox logic: put a chokepoint in the path. Docker’s open-source MCP Gateway, introduced about a year ago, routes every tool call through a single enforcement point where it can be authenticated, authorized and logged before reaching the external system, giving agents access to trusted catalogs of MCP servers instead of the open internet. The panelists added the organizational layer: a “golden repository” of verified tools, proper credential management, and centralized administration so tool access is minimal by default, per the blog post.
A Starting Checklist for Smaller Teams
You do not need a Fortune 500 security budget to apply the doctrine. A minimal translation:
- Never run coding agents directly on the host — use a sandboxed runtime (Docker Sandboxes or equivalent MicroVM/container isolation).
- Give agents a short allow-list of base images and registries instead of unrestricted pulls.
- Add a release-age cooldown for dependencies agents are allowed to install.
- Route all MCP/tool traffic through one gateway you can log and audit.
- Start agents on non-sensitive data until the team has built operational muscle — the panel’s “training-wheels approach” — because, as one panelist put it, what’s coming “is going to totally exceed anything that we have today.”
The honest caveat in the post is its timeline: Docker’s own view is that the broken parts of the open-source supply chain “won’t get fixed within the next six to 12 months.” Guardrails, in other words, are not a transitional inconvenience while the ecosystem matures. For the foreseeable future, they are the only thing standing between agentic speed and agentic incident reports.
