What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Putting an agent’s shell inside a container does not make its commands safe. It only decides where they run. OpenAI’s sandbox security documentation puts it plainly: “Agent-generated code can access the files, credentials, and network available to its environment.” Whatever you mount, inject, or leave reachable is available to the agent’s commands.
Human approval is the usual second layer, and it fails in a different way. Constant prompts wear people down, and OpenAI says this pushes some users toward full-access modes, broad command rules, or approvals given without understanding the consequences. A workable design treats shell access as a layered authorization problem: isolate execution, shrink what the environment can reach, keep trusted orchestration outside it, and spend human attention only on exact, well-scoped actions that matter. This guide is for engineering leads, developers, and security teams running coding agents or other shell-enabled agents.
As an Amazon Associate I earn from qualifying purchases.
Why a container is not a security policy
A shell tool is a capability to launch processes. A container can limit what those processes touch, but the limit is whatever you configured. A broadly privileged token in an environment variable, a sensitive bind mount, open outbound networking, or an elevated process user all remain usable by any command the model generates, whether the model is behaving well, is mistaken, or is being steered by injected text.
Recommended Free Tools
The sources do not support saying that containers are inherently weak, or that one runtime is sufficient. They support a narrower point: the boundary is only as useful as its configuration.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
| What the environment exposes | What a shell command can do with it | Direction OpenAI’s guidance points |
|---|---|---|
| Mounted files and directories | Read, modify, or exfiltrate anything mounted | Mount as little as possible; keep data that must not be shared in separate user or workload environments |
| Stored secrets or API keys | Read and use them; an injected secret is exposed to agent-generated code | Keep the application API key outside the environment; broker third-party credentials through a trusted proxy or server |
| Outbound network | Send data to, or fetch instructions from, arbitrary hosts | Restrict egress to approved endpoints |
| Process privileges | Use any privilege the agent process holds, regardless of command-level permissions | Review the privilege level of the process itself; in the Codex Action, use drop-sudo or a deliberately configured unprivileged user |
Sources: OpenAI API documentation, “Sandbox security,” and the openai/codex-action security documentation.
Keep the trusted harness outside the execution boundary
The second question is whether your control plane shares a boundary with model-directed code. OpenAI’s Agents SDK “Sandbox Agents” guide splits the roles. The harness owns the agent loop, model calls, tool routing, handoffs, approvals, tracing, recovery, and run state. The sandbox compute owns filesystem and shell work. The guide notes that running the harness inside the sandbox is convenient for prototypes, but it places orchestration and model-directed execution in the same compute boundary.
The practical benefit of separation is that authentication, billing, audit logs, human review, and recovery state stay in infrastructure the agent’s commands cannot reach. If the sandbox is compromised or discarded, the record of what was approved and executed survives.
A hardening checklist for the execution environment
The following consolidates the recommendations in OpenAI’s sandbox and Codex Action documentation. The ordering is ours.
- Run agent code on isolated compute, not on a host that also holds your trusted services.
- Minimize mounts. Expose only the paths the task needs, and separate environments per user or workload when data must not be shared.
- Allow only the outbound hosts the task requires. Default-open egress undermines every other control.
- Keep the application API key and long-lived credentials out of the environment.
- Broker third-party access through a trusted proxy or server that holds the secret and enforces its own scope, rather than injecting a stored secret.
- Check the privilege of the agent process. Command permissions and process privileges are different things.
- Keep audit, tracing, and recovery state in the harness, outside the sandbox.
Sandboxing and approval policy are separate controls
OpenAI’s “Running Codex safely at OpenAI” article states that “Approvals and sandboxing work together,” and describes distinct jobs. The sandbox sets where Codex can write, whether it has network access, and which paths are protected. The approval policy determines when it must ask before acting, including for actions outside the sandbox. Neither substitutes for the other: a sandbox without approvals has no way to handle legitimate boundary-crossing requests safely, and approvals without a sandbox put the whole burden on a human reading prompts.
If you build your own agent system, OpenAI’s “Guardrails and human review” guidance adds a caution: agent-level input and output guardrails do not necessarily run around every tool call. Put checks close to the tool that creates the side effect. Applications built on the Responses API or Agents SDK also do not inherit Codex’s Auto-review; you have to implement review and enforcement in your own harness.
What a sound review sequence contains
OpenAI’s guidance for custom systems describes this flow before a tool runs:
- Validate the exact target, action, tool arguments, calling identity, and engagement window against the approved scope.
- Send the proposed action to a separate policy component or reviewer.
- Deny requests that are out of scope or harmful.
- Pause ambiguous or high-risk actions for explicit human approval.
- Enforce independent boundaries (network, filesystem, credentials) so a wrong approval cannot grant unlimited reach.
- Fail closed if review is unavailable.
Why approval loops break
The failure mode is human, not technical. OpenAI’s Auto-review article says frequent manual prompts frustrate users, and that some respond by switching to full access, writing overly broad command-prefix rules, or approving without understanding what they are approving. This is OpenAI’s account of its own product and internal observations. It is not a measured prevalence across the industry.
Rank #3
- 🔐 Holds Two NFC Security Keys Designed to store up to two NFC security keys in one compact case. Keep your primary and backup authentication keys together for convenient organization at home, in the office, or while traveling.
- 🗂 Organized and Easy to Carry A compact storage solution that fits easily into backpacks, laptop bags, desk drawers, travel organizers, and everyday carry pouches. Helps keep authentication devices together and easy to locate.
- 🔄 Secure Screw-On Lid Features a threaded screw-top closure that stays securely fastened during everyday transport while allowing quick access whenever your security keys are needed.
- 🤲 Textured Grip Design The spiral-textured exterior provides a comfortable grip, making the lid easy to open and close. The unique design also gives the case a clean, modern appearance.
- 🖨 Durable Construction Manufactured from lightweight, durable plastic using precision engineering. Built to provide a practical storage solution for everyday organization of NFC security keys.
Each of those responses weakens the control in a specific way:
- Full access removes the approval gate entirely, leaving only whatever sandbox limits remain.
- Broad prefix rules turn one decision into a standing grant covering many future commands, including ones nobody looked at.
- Rubber-stamping keeps the prompt but removes the judgment, so the log shows consent that did not really happen.
The lesson is that approval count is a cost to design down, not a safety metric to maximize. Prompts that fire for routine, low-risk, already-sandboxed work teach people to ignore the prompts that matter.
Automated review: what OpenAI reports, and its limits
OpenAI’s alignment team describes Auto-review as a separate agent that grades boundary-crossing requests against user intent, environment, security policy, and likely impact. It reports that repeated denials can stop a trajectory, which is meant to reduce the chance of the working agent probing the reviewer. The following figures all come from OpenAI’s 2026 article about its own internal deployment and evaluations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Reported figure | Value (OpenAI, 2026) |
|---|---|
| Human approval interruptions vs. manual approval mode | Roughly 200x fewer |
| Auto-approval rate on escalated actions | 99.1% |
| Effective approval rate across all actions, internal deployment | 99.93% |
| Recall on synthetic over-eagerness cases | 90.3% |
| Recall on combined synthetic prompt-injection categories | 99.3% |
| Recall on MonitoringBench [Hard] | 96.1% |
Read these carefully. They are self-reported, no independent benchmark of them was found, and OpenAI itself says the ratios vary by use case, environment, and sandbox configuration. The recall figures are on synthetic or benchmark sets, so they do not translate directly into real-world catch rates for your agent. Treat Auto-review as a design pattern, a separate reviewer with its own policy and an escalation path, and evaluate any equivalent against your own workloads before relying on it.
Untrusted content: approval does not neutralize it
For agents triggered by pull requests, issues, or other external content, the openai/codex-action documentation lists several prompt-injection surfaces: hidden HTML in pull-request bodies, overlooked commit messages, repository instruction files such as AGENTS.md, and screenshots. It also warns that manually approving a workflow triggered by arbitrary external content is not a complete defense, since a reviewer may not see the injected text at all. Its recommendations are to limit who can trigger workflows and to grant the narrowest filesystem and network permission profile that still lets the task finish.
Shell injection happens before the agent runs
There is also an ordinary, non-AI hazard in the same pipeline. GitHub Actions expands ${{ ... }} expressions before the shell executes a run: block, so splicing untrusted branch names, issue titles, comments, or action inputs directly into shell source can break quoting and execute arbitrary commands. The documented safer pattern passes the value through env: and quotes the variable in the script:
# Risky: the title is expanded into the shell source
- run: echo "${{ github.event.issue.title }}"
# Safer: the value arrives as an environment variable
- env:
ISSUE_TITLE: ${{ github.event.issue.title }}
run: echo "$ISSUE_TITLE"Can the agent run something other than what you approved?
A preprint submitted to arXiv on September 30, 2026 (Yang Wang, “Approval Laundering: Systematizing Approval–Execution Binding Failures in AI Coding-Agent Harnesses,” arXiv 2609.38983) asks exactly this: is the action a human approved the same one the harness dispatches? It names six failure classes: scope, argument, temporal, tool, delegation, and semantic laundering.
The author reports controlled repeated-measures experiments that instrument Claude Code’s pre-execution mediation point, plus a prototype approval token. The token addresses delegation and one seeded temporal construction. It does not address scope laundering, and the paper reports no significant reduction for its tested argument-laundering case. This is early, unreviewed preprint evidence from a bounded setup. It does not establish how often these failures occur in any product.
Best Value
- HEAVY DUTY KEYED PADLOCK: Single lock weights up to 2LB. Brass body, Solid hardened steel shackle, both chrome plated. Unique D shape makes it perfect solution for securing containers, gates. Also can be used when locking up the chain on your motorbikes. Note the size to ensure the hasp fits the latch！
- TOP SECURITY PADLOCK: Long shackle steel padlock, durable and secure you can trust. The high security padlock is heel toe locking with a freely rotating hardened steel shackle.This advanced design leaves no weak spots on the lock and prevents attacks by cutting or sawing.
- WEATHERPROOF & HIGH ANTI-CORROSION: Lock body, Shackle & cylinder cover are in high resistance and waterproof even under strong acid. Both lock body and shackle provide maximum corrosion protection during outdoor or indoor use.
- KEY RETAINING – The Nestling Padlocks come with 5 stainless steel keys and are key retaining. The sturdy keys can only be removed from the padlock when it is in the locked position.
- KEYED DIFFERENT – This lock ships keyed different, so each lock comes with a different key set. Do not worry that other person has the same lock and keys. 100% keep your stuff safe.
Design implication (our inference, not an empirical result of the paper): if approval is to mean anything, the screen should show the real target and arguments rather than a vague label, and the enforcement layer should bind the reviewed action to the invocation that is dispatched. A broad session grant, or a summary like “run tests,” leaves scope and identity details unexamined. This is consistent with OpenAI’s recommendation to validate exact targets, arguments, and identity.
Designing approval checkpoints that stay meaningful
The sources do not give a single prescribed policy. Combining their recommendations, a defensible shape looks like this; the tiering below is our synthesis rather than an OpenAI specification.
| Tier | Example condition | Handling |
|---|---|---|
| Contained | Action stays inside the sandbox’s write scope and allowed hosts | No prompt; the boundary does the work |
| Clearly out of scope or harmful | Target, identity, or engagement window does not match approved scope | Deny automatically |
| Ambiguous or high-risk | Side effects outside the sandbox, or unclear intent | Separate reviewer, then explicit human approval showing exact target and arguments |
| Reviewer unavailable | Policy service down or timing out | Fail closed |
- Shrink the set of actions that need a human by tightening the sandbox first. Fewer escalations is the safest way to reduce fatigue.
- Prefer narrow, expiring grants to prefix rules or session-wide full access.
- Do not give an approval to anything triggered by external content merely because someone clicked a button; restrict who can trigger it and limit what it can reach.
- Log the approved action alongside the dispatched one in the trusted harness, so a mismatch is detectable afterwards.
Comparing architectures
The sources describe real implementation choices but do not establish a vendor-neutral performance comparison, so this is a set of questions to ask rather than a ranking of providers.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Axis | Weaker posture | Stronger posture |
|---|---|---|
| Isolation | Agent runs on the host | Remote isolated compute |
| Harness location | Inside the execution boundary | Outside, with sandbox as a worker |
| Filesystem | Broad mounts shared across users | Minimal, per-workload mounts |
| Egress | Open outbound access | Approved endpoints only |
| Credentials | Long-lived secrets injected | Absent, scoped, or brokered |
| Review | Blanket grants or constant manual prompts | Policy or separate-agent review with human escalation for high-risk actions |
| Approval binding | Label-level approval | Exact tool, arguments, and identity bound to dispatch |
| Operations | No trusted record; fails open | Audit and recovery outside the sandbox; fails closed |
Pick the stronger posture on the axes where your agent can cause irreversible harm first: credentials and egress usually matter more than any prompt wording.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
