Sandboxing AI agents at the kernel level | Dark Hacker News