Binance just started letting AI agents trade crypto on behalf of users. OneCLI, a YC S26 startup, launched an open-source sandboxed harness for running AI agents in teams. And developers are talking seriously about building “extensible software” where LLMs fill in custom functionality on the fly.

The timing isn’t a coincidence. We’re past the “can AI agents do anything useful?” phase and deep into “how do we keep them from doing too much?”

Binance Agent OS

Binance’s new Agent OS works with ChatGPT, Claude Code, and Cursor to execute trades. The details matter here: you’re not giving an AI direct API access to your exchange account. You’re giving it structured tools it can call, and Binance handles the execution.

This is the right approach, but it’s also incomplete. According to TechCrunch, “keeping them in check is largely up to users.” That means you need to understand what the agent can do, set appropriate limits, and monitor what it’s actually doing. Most people won’t do that correctly.

If you’re building systems that let AI agents touch money or production infrastructure, this is what the pattern looks like right now. Tool-based access with user-defined guardrails. It’s better than nothing. It’s not enough.

OneCLI

OneCLI takes a different approach. It’s a sandboxed harness specifically built for running multiple AI agents as a team. The “sandboxed” part is doing real work here: limiting what agents can access, what commands they can run, what files they can touch.

The project is open source and just launched on Hacker News via a Show HN post. YC companies don’t usually open-source their core product on day one unless they’re trying to establish a standard or they know the value is in the orchestration layer above the basic tooling.

For teams already running AI agents in production, or planning to, this is worth evaluating. The question isn’t whether you need sandboxing. You do. The question is whether you build it yourself or use something like OneCLI.

The Bigger Pattern

Jeremy Morrell published a piece this week on “extensible software in the age of LLMs.” His thesis: LLMs make it cheap to write extensions, and modern sandbox primitives make it safe to run them. You can build a solid core application and let users extend it in arbitrary directions by having AI fill in the custom logic.

This only works if the sandboxing actually holds. That’s the part everyone is still figuring out.

Simon Willison has been tracking this too, highlighting both Morrell’s post and a project called smolmachines that provides sandboxed execution for untrusted Python and JavaScript. The fact that multiple people are working on similar sandboxing solutions from different angles suggests this is a real need, not a hypothetical one.

What This Means

If you’re building with AI agents, you need a threat model. Not for AGI safety or alignment, but for boring operational security. What can this agent access? What’s the blast radius if it halts and catches fire? How do you rate-limit it? How do you kill it if it goes into a loop?

The tooling is getting better, but it’s still early. Binance is shipping agent trading with basic guardrails. OneCLI is providing better sandboxing for multi-agent systems. Developers are writing about extensible software architectures that assume AI-generated code running in sandboxes.

None of this is production-ready in the “set it and forget it” sense. But if you’re waiting for that, you’re going to be late. The people shipping AI agent features today are the ones figuring out sandboxing as they go.

Also Shipped

OpenAI announced Zero Data Retention for frontier models, expanding their existing API privacy guarantees and previewing something called Private Safety Processing. The pitch is that they can run advanced safety checks on your requests without retaining your data. If you’re in a regulated industry or handling sensitive data, this matters. If you’re not, it’s table stakes.

GitHub published another beginner’s guide to Copilot, this time covering the “My work” pane for tracking multiple sessions. It’s fine. If you’re already using Copilot, you probably found this feature already. If you’re not, this won’t convince you to start.