{
  "schema_version": "1.1",
  "id": "s8:https://www.youtube.com/watch?v=4lXks428C9o",
  "slug": "we-let-an-ai-agent-execute-bash-and-lived-to-talk-about-it-sarah-sanders-0pgksvk",
  "url": "https://feed7.dev/p/we-let-an-ai-agent-execute-bash-and-lived-to-talk-about-it-sarah-sanders-0pgksvk",
  "title": "We let an AI agent execute Bash and lived to talk about it — Sarah Sanders, PostHog",
  "why_included": "PostHog treats every context source as part of an agent’s supply chain, scanning at build and use time while reserving blocking decisions for deterministic controls.",
  "summary": "PostHog’s setup agent runs for about **8,000 users per week** and consumes docs, prompts and example apps as skill bundles. Its threat model includes poisoned first-party content, so inputs are scanned when skills are built and again when the agent uses them.",
  "practical_implication": "For any agent that can execute commands, make Bash **deny by default**, keep secrets outside model context, and scan both incoming context and generated output. Enforcement should remain deterministic; an LLM may triage noise only after mechanical rules have decided not to block.",
  "agent_context": "PostHog’s setup agent runs for about **8,000 users per week** and consumes docs, prompts and example apps as skill bundles. Its threat model includes poisoned first-party content, so inputs are scanned when skills are built and again when the agent uses them.\n\nFor any agent that can execute commands, make Bash **deny by default**, keep secrets outside model context, and scan both incoming context and generated output. Enforcement should remain deterministic; an LLM may triage noise only after mechanical rules have decided not to block.\n\nPostHog reports almost no malicious prompt injection found in the wild and many false positives. Rule quality therefore depends on positive and negative tests, impact-based severity, telemetry and layered controls; no individual scanner or sandbox is sufficient.",
  "source": {
    "name": "AI Engineer",
    "url": "https://www.youtube.com/watch?v=4lXks428C9o",
    "published_at": "2026-09-14T16:00:00.000Z"
  },
  "source_class": "video",
  "content_type": "Video",
  "layer": "agent",
  "domains": [
    "coding",
    "security"
  ],
  "topics": [
    "harness-engineering",
    "sandboxing",
    "agent-reliability"
  ],
  "verification": {
    "status": "source_linked",
    "label": "Source Linked",
    "method": "source_feed",
    "verified_at": null
  },
  "uncertainty": [
    "PostHog reports almost no malicious prompt injection found in the wild and many false positives. Rule quality therefore depends on positive and negative tests, impact-based severity, telemetry and layered controls; no individual scanner or sandbox is sufficient."
  ],
  "connected_context": {
    "meaning": "This turns general warnings about Bash-capable agents into a deployed layered-control pattern and adds a subtle calibration lesson: real attacks were rare while false positives were common. It reinforces external, deterministic enforcement and least privilege, but narrows scanner-centric security claims because safe operation still depends on tested rules, secret isolation, telemetry, sandboxing and bounded authority rather than any single detection layer.",
    "corpus_size": 778,
    "generated_at": "2026-09-15T10:06:10.015Z",
    "connections": [
      {
        "title": "IT Admin for the AI Workforce — Sarthak Aggarwal, Decawork",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=q-WOjZhOMCA",
        "feed7_url": "https://feed7.dev/p/it-admin-for-the-ai-workforce-sarthak-aggarwal-decawork-0oxlc5t",
        "reason": "Decawork extends deny-by-default Bash into identity and authorization: scoped capabilities, revocation and audit receipts must be enforced outside the model for every action."
      },
      {
        "title": "Give the Agent a Budget, Not a Token — Sachin Malhotra, Anthropic",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=rbjWzZK2LU0",
        "feed7_url": "https://feed7.dev/p/give-the-agent-a-budget-not-a-token-sachin-malhotra-anthropic-1sm80qu",
        "reason": "Anthropic’s deletion incident shows why an allowed command still needs quantitative blast-radius limits, rate controls and human-held overrides."
      },
      {
        "title": "From coding to Knowledge work agents — Karan Vaidya, Composio",
        "source_name": "AI Engineer",
        "source_url": "https://www.youtube.com/watch?v=xxfMT-bPEmU",
        "feed7_url": "https://feed7.dev/p/from-coding-to-knowledge-work-agents-karan-vaidya-composio-14b5s5w",
        "reason": "Composio generalizes the same control boundary beyond Bash through action records, enforced permissions and preflight checks for irreversible operations."
      },
      {
        "title": "apache/maka",
        "source_name": "GitHub",
        "source_url": "https://github.com/apache/maka",
        "feed7_url": "https://feed7.dev/p/maka-01vaj44",
        "reason": "Maka supplies complementary runtime primitives—sandboxing, durable event history, replay and recovery—that make blocked or permitted agent actions inspectable and testable."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-09-14T16:00:00.000Z",
  "modified_at": "2026-09-14T16:00:00.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/we-let-an-ai-agent-execute-bash-and-lived-to-talk-about-it-sarah-sanders-0pgksvk",
    "json": "https://feed7.dev/p/we-let-an-ai-agent-execute-bash-and-lived-to-talk-about-it-sarah-sanders-0pgksvk.json",
    "markdown": "https://feed7.dev/p/we-let-an-ai-agent-execute-bash-and-lived-to-talk-about-it-sarah-sanders-0pgksvk.md"
  }
}