As autonomous AI agents gain the ability to write code, execute workflows, and operate enterprise systems, a parallel effort is underway to make sure they can't go rogue.
Autonomous coding agents have moved well past the demo phase. They read codebases, write patches, spin up environments, and chain together multi-step workflows with minimal human oversight. In 2026, the leading AI companies aren't just competing on how capable these agents are — they're competing on how controllable they remain. NVIDIA is building sandbox infrastructure to constrain agent behavior at the system level. Anthropic is shipping models it claims are safer and more aligned than ever. OpenAI has published research on monitoring its own internal coding agents for signs of misalignment. And GitHub is opening its platform to third-party agents from multiple providers. The result is an industry that's simultaneously stepping on the gas and reaching for the brakes.
The Capability Leap
To understand why security and alignment are getting so much attention, look at what these agents can actually do now.
Anthropic's Claude Sonnet 4.6, released in February 2026, represents a full generational upgrade in coding, computer use, long-context reasoning, and agent planning. According to Anthropic, developers with early access preferred Sonnet 4.6 over its predecessor "by a wide margin," and many even preferred it to Claude Opus 4.5, the company's most powerful model from late 2025. The model ships with a 1-million-token context window in beta, meaning it can ingest and reason over entire codebases in a single session.
That context window matters. As Anthropic noted when expanding context support for Claude Sonnet 4, a 5x increase in token capacity lets developers process entire repositories, synthesize sprawling document sets, and maintain coherent reasoning across long, complex tasks. For coding agents, more context means fewer hallucinations about code that's out of view and more reliable multi-file refactors.
Anthropic's earlier model, Claude Sonnet 4.5, shipped in September 2025 alongside the Claude Agent SDK, giving developers the same infrastructure Anthropic uses internally to build Claude Code. The progression from Sonnet 4.5 to 4.6 shows how quickly the capability floor is rising: what once required an Opus-class model, including economically valuable office tasks, now runs on a mid-tier Sonnet.
Meanwhile, as TechRadar reported, GitHub has integrated both Claude and OpenAI's Codex agents directly into its platform, letting developers choose between third-party coding agents without leaving their existing workflow. This isn't just a convenience play. It signals that coding agents are becoming commoditized infrastructure, and the competitive differentiators are shifting toward reliability, safety, and enterprise trust.
Sandboxing the Agent: NVIDIA's Infrastructure Bet
More capable agents create more surface area for things to go wrong. An agent that can read files, execute code, and call external APIs can also leak credentials, exfiltrate data, or override safety policies — especially if it's been compromised or is behaving in unexpected ways.
NVIDIA's response is OpenShell, an open-source runtime designed to enforce security policies at the infrastructure level rather than relying on behavioral prompts or model-level guardrails. As NVIDIA described in a blog post detailing the project, OpenShell ensures each agent runs inside its own sandbox, separating what the agent does from what the system allows. Security policies sit outside the agent's reach entirely — applied at the system level, not the application level.
NVIDIA compares this to the browser tab model: sessions are isolated, resources are controlled, and permissions are verified by the runtime before any action occurs. The key insight is that application-layer risk "grows exponentially when agents continuously improve and evolve." Telling an agent not to do something via a prompt is fundamentally less reliable than making the environment physically incapable of allowing it.
OpenShell is part of NVIDIA's broader Agent Toolkit and is designed to work across different agent types — coding agents, research assistants, agentic workflows — under a single unified policy layer. NVIDIA is collaborating with Cisco, CrowdStrike, Google Cloud, Microsoft Security, and TrendAI to align runtime policy management across the enterprise stack.
This approach reflects a growing consensus in the industry: you can't secure agents by making them promise to behave. You secure them by constraining the environment they operate in.
The Alignment Question
Security and alignment are related but distinct problems. Security asks: can the agent be prevented from doing harmful things? Alignment asks: does the agent actually want to do what you intended?
OpenAI has been working on the latter question internally. The company published research titled "How we monitor internal coding agents for misalignment," as indicated by a post on OpenAI's site. While the specifics of that research weren't available for this article, the title alone is notable: OpenAI is publicly acknowledging that its own internal coding agents require active monitoring for misalignment, not just external-facing products.
Anthropic, for its part, leans heavily on safety evaluations with each model release. The company's safety researchers concluded that Sonnet 4.6 has "a broadly warm, honest, prosocial, and at times funny character, very strong safety behaviors, and no signs of major concerns around high-stakes forms of misalignment," according to Anthropic's announcement. That's a qualitative assessment, not a guarantee, but it signals that Anthropic views character-level alignment as a publishable metric — something it wants customers to evaluate when choosing a model.
The tension between capability and alignment is real. Models are getting better at coding tasks at a pace that outstrips the development of evaluation frameworks. A simple illustration: Opper's "car wash test," published in February 2026, asked 53 leading models whether you should walk or drive 50 meters to a car wash. The correct answer is drive — you need the car there. On a single call, only 11 of 53 models got it right. Across 10 repeated runs, consistency dropped further. These are models trusted to write and execute production code, yet many fail a reasoning task any human solves instantly.
The car wash test is trivial, but the failure mode it reveals isn't. Models often produce "correct reasoning about the wrong problem," as Opper put it — fixating on surface-level cues (50 meters is short, so walk) while missing the actual constraint. In a coding context, that pattern can mean an agent that writes syntactically correct code solving the wrong problem, or optimizes for a metric that doesn't match the user's intent.
What This Means for Developers and Enterprises
Three dynamics are converging. First, coding agents are becoming powerful enough to handle real production work, not just boilerplate. Second, the infrastructure to constrain and monitor those agents is maturing in parallel, with NVIDIA's OpenShell representing the hardware-adjacent approach and model-level alignment representing the software approach. Third, platforms like GitHub are making these agents accessible to any developer, not just teams with the resources to build custom integrations.
For enterprises, the practical question is shifting from "should we use coding agents?" to "how do we govern them?" NVIDIA's unified policy layer model — where coding agents, research assistants, and other agentic workflows all operate under the same runtime constraints — offers one answer. It treats agent governance as an infrastructure concern, like network security or access control, rather than an application-level afterthought.
For individual developers, the stakes are different but no less real. An agent that can handle Opus-class coding tasks at Sonnet-class pricing, as Anthropic claims for Sonnet 4.6, changes the economics of software development. But it also means developers increasingly need to verify agent output rather than write code themselves — a different skill set that demands new tools and habits.
What Comes Next
The industry is moving toward a layered model of agent safety: model-level alignment (Anthropic's character evaluations, OpenAI's misalignment monitoring), infrastructure-level enforcement (NVIDIA's OpenShell sandboxing), and platform-level governance (GitHub's multi-agent integrations with audit trails). No single layer is sufficient on its own.
The harder problem is what happens when agents start modifying their own capabilities. NVIDIA's OpenShell documentation explicitly flags this: agents that "continuously improve and evolve" create compounding risk. Today's sandbox constraints may not anticipate tomorrow's agent behaviors.
For now, the industry's approach is pragmatic: ship the capability, ship the guardrails, iterate on both. Whether that's fast enough depends on how quickly these agents move from writing pull requests to running production systems unsupervised. Based on the trajectory from Sonnet 4.5 to 4.6 — roughly five months for a generational leap — the window for getting governance right is measured in quarters, not years.
