Between Qwen trying to upload a file to Beijing and coding agents getting hijacked by a stray AGENTS.md, I’ve been thinking about one question: what is a local model actually talking to? Running a model locally doesn’t mean it stays local if you give it tools. Here’s the generic checklist I’d use.
- Default deny outbound. Run models and agents in a container or VM with no network unless the task needs it.
- Allowlist, don’t blocklist. If it needs the internet, allow only the specific destinations it needs.
- Log DNS and connections. An unexpected lookup is often your first clue.
- Don’t trust the reasoning trace. Qwen’s said it used no tools while it tried a curl. Check actual tool calls and network logs.
- Gate tools. Shell, package installs and file uploads should need approval.
- Keep secrets out of reach. Don’t mount API keys or SSH keys into the sandbox.
- Check working directories for AGENTS.md or similar instruction files before you start.
- Verify model files come from the official source and match published checksums.
God Bless, and Happy hacking!
