Cisco's open source chief: agent sandboxes alone won't stop AI attacks

Isovalent — the Cisco-acquired steward of the eBPF-based Cilium and Tetragon projects — has pushed back on the microVM agent-sandbox hype dominating this week's KubeCon in Salt Lake City, arguing that isolation without deep runtime visibility leaves enterprises blind when AI agents misbehave.

Liz Rice, chief open source officer at Isovalent, has spent a decade watching cloud-native infrastructure converge — networking folding into security, containers folding into the kernel itself. Isovalent sits squarely at that intersection. Cisco acquired the company in late 2023 and has since folded its technology into Cisco's Linux-based switching gear. Cilium uses the extended Berkeley Packet Filter (eBPF) to orchestrate traffic through a lightweight service mesh inside Kubernetes clusters; Tetragon handles application runtime observability and policy enforcement.

Rice has an obvious stake here — Isovalent sells container-based runtime security, not the microVM-based agent sandboxes grabbing headlines at the conference. But she also sits on the governing board of the Cloud Native Computing Foundation, where she says the microVM question is far from settled.

What's the right isolation boundary for AI agents?

"We're seeing a lot of debate … around what's necessary from a sandboxing point of view," Rice said in an interview on the IT Ops Query podcast this week. "A lot of that is a work in progress. … It's almost philosophical now, about what's the right isolation boundary for agents."

The microVM camp — including Google's gVisor and Kata Containers — argues that lighter-weight virtual machines strike a balance: near-container performance with the stronger OS-level isolation of full VMs. These projects integrate with the agent sandbox offerings that Nvidia and Google contributed to the CNCF. Elsewhere at the conference, updates from Broadcom and SUSE blurred the old lines between VM and container management even further.

Rice isn't dismissive. MicroVMs have come a long way fast.

"There's a lot of potential in these microVMs, and it's interesting to compare this to five years ago, let's say, when spinning up a VM was a matter of many, many, many seconds at least, whereas now with microVMs, it's much faster," she said. "But it does create different tensions for things like observability … and the performance is not quite the same as we're going to get with the regular container runtime."

Why visibility matters more than stronger walls

That observability tension is her core argument. MicroVMs isolate better than containers, but they also obscure what's actually running inside them. Rice's position: preventive containment of malicious or misaligned AI agents only goes so far. When — not if — suspicious behavior shows up, deep, rapid visibility is what catches it quickly.

Tetragon takes the container route instead of the VM route, which Rice said suits the high-scale, wire-speed network operations that agentic infrastructure demands. It's already doing production work: Tetragon underpins Cisco's Live Protect virtual patching feature, rolled out in June, which shields Cisco smart switches from attacks exploiting newly discovered vulnerabilities faster than upstream patches can ship.

"We have to have runtime security protections and mitigations because we just can't afford the time to roll out patches. We can't anticipate all possible attacks," Rice said. "It's been possible in theory for a long time, but there's always [been] concern about affecting normal operations. But with the onslaught of vulnerabilities, the balance of risk is changing, and it makes more and more sense for people to put those guardrails in."

What does this change for security teams?

Probably nothing immediately — and that's partly the point. Rice frames this as a defense-in-depth story, not an either-or choice. Most enterprises will run multiple layers: sandboxes where the workload warrants them, runtime enforcement and observability underneath, virtual patching on top of infrastructure that can't wait for vendors.

The practical takeaway for CIOs weighing agentic AI rollouts: don't let the sandbox debate become a reason to stall on runtime security. The balance between the scale and performance agents demand — and running them safely — will remain the hard part, according to Rice. Isolation boundaries are still, by her own description, a work in progress inside the CNCF.

In the meantime, the guardrails that already exist are getting easier to justify.