The Three-UID Containment Pattern for AI Agents on Linux

<p>If your agent egress story is "we set HTTPS_PROXY to point at the proxy," the proxy is asking nicely. The kernel has no opinion on what the agent does next.</p> <p>This post is

<p>Your agent passed all the tests. It's been running in production for three weeks. And it has been quietly wrong the entire time.</p> <p>This is not a hypothetical. Galileo's

<p>Everyone builds demo agents. They work great in the terminal. You show them to your coworker, they say "wow." You feel like a genius for about forty-five minutes.</p> <p>Then

<!-- SC_OFF --><div class="md"><p>I have built a programmable governance layer for AI agents. I am considering to open source completely. Looking for feedback.</p> <p>Agent demos

<p>In January and February 2026, security researchers filed <a href="https://www.heyuan110.com/posts/ai/2026-03-10-mcp-security-2026/" rel="noopener noreferrer">30 CVEs against

<p><em>8 dimensions. 38 checks. 5 seconds. 0% industry pass rate.</em></p> <h2> The Problem </h2> <p>DAST exists for web apps. DAST exists for APIs. DAST does not exist for AI

<p><em>Originally published at <a