Build and harden a network sandbox for an AI recon agent

The poster is building a bug-bounty pipeline on GitHub Actions in which a recon agent never touches the network: every request goes through a broker that checks an authorization only the poster can sign. Two AI systems did the engineering of that boundary. ChatGPT wrote each change as a candidate and ran what it could in its own container. Claude reviewed every candidate on its own: read the diffs, reran the test suites in its Linux sandbox and checked results against GitHub's run records. The poster held repository approvals and, partway through, required each approval to name the repo, branch, operation and exact commit.

The first jail passed 13 of 13 isolation checks on a GitHub runner, yet the agent could still reach a host process through a filesystem Unix socket, because the tests only probed IP traffic. A tmpfs mask over /run and /tmp passed its own check but a full scan found another socket. The real fix gave the agent a fresh root with new namespaces and one bind-mounted broker socket. It passed 21 of 21 locally, timed out on GitHub, and took two more versions to pass there. Five more layers followed (CI gate, loopback-only broker, non-root broker with firewall rules, signed port limits, a launcher that kills the broker if it dies), each merged with CI green after review caught something.

Two bugs only existed on the real GitHub runner, so the poster ran every check on several machines on purpose. A plain 'go ahead' was once taken as merge approval, which led to the exact-commit rule. The poster says nothing has been tried by an independent attacker, and the agent harnesses are not named beyond ChatGPT and Claude.