What if the network was the sandbox? — Remy Guercio, Tailscale

June 1, 202624:295,946 views

Summary

Remy Guercio from Tailscale presents a reframing of AI agent sandboxing at AI Engineer Europe 2026, arguing that the conventional approach conflates two distinct problems: execution isolation and access control. Standard sandbox implementations give the agent its own credentials — an API key, an OAuth token — which the agent can exfiltrate, misuse, or leverage creatively over long-running loops. Guercio proposes moving access control out of the sandbox entirely and into the network layer using Tailscale's WireGuard-based identity network.

The core argument breaks a sandbox into two primitives: a boundary (something inside, something outside) and a set of permissions. Today those permissions live inside the boundary, meaning the agent possesses its own credentials. Guercio's alternative is to push identity and authorization to the network level. Every connection on a Tailscale network carries verified identity — a logged-in user, SCIM-synced group memberships, or a machine tag (e.g., 'PR review bot for project X') — without any credential stored in the running process. The receiving service sees full identity metadata on every packet, not just an IP address plus an API key.

Built on top of these primitives is Aperture, Tailscale's AI gateway. Operators put a single provider key (Anthropic, OpenAI, Gemini, Bedrock, Vertex, etc.) into Aperture. Agents connect from their sandbox using a placeholder rather than a real key — there is literally nothing to exfiltrate. Because every LLM call must pass through the network layer, Aperture gains complete, uninstrumented visibility into every tool call, bash command, and MCP request the agent makes, without requiring any code changes inside the container or the agent harness.

Guercio demonstrates this live using a GitHub Actions PR review bot running on Tailscale with federated OIDC. The runner acquires a tag on the tailnet when it spins up; Aperture reads that tag to determine permitted models, quotas, and MCP access. The live demo shows token usage, per-identity spend breakdowns, full request/response bodies, and extracted tool call logs. Internally at Tailscale, bash commands dominate over structured MCP tool calls — a fact Aperture revealed and that was previously invisible.

Additional product capabilities shown include cross-provider budget controls (a single dollar quota that spans all providers), per-team and per-user quotas (e.g., unlimited internal GPU endpoints but capped spend on Claude Opus), and guaranteed webhook delivery on every tool call because the hook fires at the network layer and cannot be bypassed. Permissions can be configured in two places: the Aperture UI (grants UI, soon supporting SCIM groups) or the Tailscale policy/ACL file via application capabilities, enabling GitOps workflows.

For the Q&A, Guercio addresses transparent base-URL proxying (technically possible but deliberately avoided to keep behavior visible), permissioning by model vs. provider vs. user (model/provider today, user-level coming), and the harder case of agents that write and execute code directly rather than using structured tool calls. His answer: that is precisely why Aperture operates at the LLM request layer rather than the MCP layer — even code-writing agents must still issue LLM API calls, so every bash command embedded in an LLM response is captured at the network boundary before execution.

Aperture is available on Tailscale's free plan. The underlying identity primitives are exposed via tsnet, an open-source Go library, allowing teams to build their own identity-aware internal services — MCP servers, API proxies, or custom gateways — using the same WireGuard identity fabric without implementing OAuth or opening endpoints to the public internet.

Key Takeaways

•Storing credentials inside a sandbox does not eliminate the threat — the agent can still exfiltrate or misuse them; moving credentials to the network layer removes the attack surface entirely.
•Aperture gives agents a placeholder instead of a real API key: there is nothing to exfiltrate, and revocation is instant at the network level with no workaround for the agent.
•Every LLM call must transit the network, so Aperture captures 100% of tool calls, bash commands, and MCP requests without any instrumentation inside the container or agent harness.
•A single provider key in Aperture covers all supported providers (Anthropic, OpenAI, Gemini, Bedrock, Vertex), enabling unified cross-provider cost controls and quotas from one place.
•GitHub Actions runners can acquire a Tailscale identity tag via federated OIDC when they spin up, giving them verifiable, revocable network identity without hardcoded credentials.
•Bash commands dominate over structured MCP tool calls in practice — Aperture's network-layer visibility reveals actual agent behavior that was previously invisible to operators.
•Permissions should be configured at the network level via Tailscale ACL/policy files for GitOps workflows, not just in-app UI, so access control is version-controlled and auditable.
•Operating at the LLM API layer (not the MCP layer) is necessary to catch agents that write and execute code directly rather than using structured tool calls.
•Webhooks fired at the network layer are guaranteed to execute on every tool call — unlike in-process hooks, the agent cannot bypass them because it never holds the real credential.
•tsnet lets teams build their own identity-aware internal MCP servers or API proxies using Tailscale's WireGuard fabric without implementing OAuth or exposing public endpoints.

Transcript

[music] >> Yeah, hi everybody. >> [laughter] >> Thanks for joining. I know we're a little late starting. So, um yeah, I appreciate it. Uh yeah, I'm happy to um excited to talk about uh kind of a both a question that I kind of want to pose and kind of want to, you know, think about. Uh and then I'll just do a demo of something that uh basically what you can do. Uh a project that we're working on and building uh that you can do if you start to think about the network uh as more of a sandbox enviro...