It's not hard to sandbox Pi without adding anything substantial to the actual size of the system prompt, which is what HarnessTax is mostly measuring. Wrapping it in nono.sh costs approximately zero tokens.
(I do think Pi should ship with more than zero builtin sandboxing though)
I have a couple hundred line TUI that just clones an LXD container and I get all my repos and infra isolated in 5s with pi having isolation to that container. Swap between any instance. Port forward to host all automatic.
Funny to me how stuff is described these days. Seems like some people lack the full understanding of all these different systems and really overcomplicate their harness setups or use super bloated all in one tooling.
I tried putting my agent in an LXC / Incus container but then I also needed it to process videos stored on a NAS, and that was not easy at all. I tried a FUSE-based NFS client [1] but it was very flaky and would randomly report files having zero length and fail processing.
You can sandbox with tool hooks, at least in antigravity, I think a lot of other harnesses support similar features. Sandboxing via the prompt is just dangerous and unreliable.
They add a --tools flag, which can only add tools onto the built-in tools, so if you wanted to sandbox pi.dev by adding sandboxed versions of the existing tools you will have to run pi.dev via
pi --no-tools --tools tool1, tool2, tool3
except..., that's not enough to sandbox pi.dev, because remember, it's a minimalist coding agent! So what does a minimalist coding agent do? Of course! It loads extensions by default and do you know what extensions can do? they can add default tools that bypass --no-tools!
So if you want to sandbox your agent, guess what you'll have to do? Yep, you have to supply --no-extensions.
Here is how to run pi.dev under its most minimal configuration under a sandbox:
pi --no-tools --no-extensions --tools tool1, tool2, tool3 -e ./your-sandboxing-extension
For me, it's simply that I have to read Claudese instrumentally for work enough that I am not going to spend my neurons reading it idly. I am not mad about it or anything, it just sucks to open up a blog post and realize that it's just Claude again under a different name.
It's too "clunky" for AI, like you stumble too much over the words when reading
If we take the first sentence that could have been from a German person, where such language structures aren't that uncommon.
I myself write a lot like that, and always have written like that, often in way worse ways, like sentences which never, not even after docent of words, end, and have levels of sub-sentence nesting no normal thinking human would want to read. (<- yes that was intentional. I tend to write more concise today.)
Through there are indicators of AI usage in pretty much every single sentence.
But at the same time the writing is too bad, for most current AI agents.
Like reading it is hard, in ways AI tends to not mess up. There are missing filler and glue words. Including some cases where I think they are probably grammatically require (through school was too long ago, so idk.). Sometimes it looks like a different language construct was used (like bracket or -- hyphen inlays) which then where search+replaced with commas.
So I really wonder what that is?
- a lower quality LLM Model?
- AI written text modified by hand leading to it having the worst of both worlds?
- or a human who has self learned English as a second language using AI and believes this is how normal English speakers write ...
and the last option is kinda frightening, because sooner or later we will have exactly that: People who write like AI "but worse" and likely do not even realize what they are doing.
---
EDIT/PS: Side note; Rust in Python is a decent match. PyO3 is far from perfect but decently usable. Spreading more awareness about it is nice. This comment is only about the writing structure not the content of the blog post.
(I do think Pi should ship with more than zero builtin sandboxing though)
reply