Sandboxing AI agents at the kernel level | Not Hacker News!