Posted by matt_d 12 hours ago
"Why pay the waste disposal tax? Dumping into the ocean is free!"
Pi actively omits any sort of guardrails and sandboxing in the name of speed and simplicity, so it is not shocking that it is faster and simpler.
Doubling the cost of something in the name of vague security is standard operating procedure for big enterprises, maybe even quite cheap.
(I do think Pi should ship with more than zero builtin sandboxing though)
Funny to me how stuff is described these days. Seems like some people lack the full understanding of all these different systems and really overcomplicate their harness setups or use super bloated all in one tooling.
I'm looking at changing my AI harness and am definitely interested in this
They add a --tools flag, which can only add tools onto the built-in tools, so if you wanted to sandbox pi.dev by adding sandboxed versions of the existing tools you will have to run pi.dev via
pi --no-tools --tools tool1, tool2, tool3
So if you want to sandbox your agent, guess what you'll have to do? Yep, you have to supply --no-extensions.
Here is how to run pi.dev under its most minimal configuration under a sandbox:
pi --no-tools --no-extensions --tools tool1, tool2, tool3 -e ./your-sandboxing-extension
Um, no? Have you actually read Claude Code's system prompt and tools?
Here's Fable's system prompt: https://github.com/navanchauhan/agent-autopsy/blob/6d9c00e54...
There are a few lines of what I would call "for security and alignment purposes", but it's not the majority. And the majority of the bloat is from the tool descriptions.
The system prompt in this case has pretty much nothing to do with the built-in guard rails, that is: you cannot sidestep Claude's guard rails by editing/replacing the system prompt (which you officially can with Claude Code's `--system-prompt-file`).
Two examples from daily use on a small business's systems. Telling it to batch browser calls in the system prompt didn't hold; a hook that denies the seventh consecutive single call did. Telling it to record which machine did a piece of work didn't hold either; having the CLI stamp the hostname did.
Both are nearly free in tokens, and that layer is where the reliability actually came from. The prompt-size argument skips straight past it.