Papers We Love: NYC | What Saltzer & Schroeder knew in 1975 about the agents we're building in 2026

Papers We Love, Espresso AI, and Antithesis are pleased to present the September edition of PwL. Papers We Love is a community of programmers who love reading and discussing computer science papers. What was the last paper within the realm of computing you read and loved? What did it inspire you to build or tinker with? Come share the ideas in an awesome academic or research paper with fellow engineers, programmers, and paper-readers. Lead a session and show off code you wrote that implements these ideas, or just give us the lowdown on the paper. Otherwise, just come, listen, learn, and discuss. Speaker: Samuel Laferriere More about Sam: I’m a Staff Software Engineer at Seismic, where I work on the execution layer of an EVM-compatible privacy L1 — a reth fork running BFT consensus inside TDX enclaves. Before that I spent three years at EigenLabs, where I led the integrations team for EigenDA, a high-throughput BFT blobstore, building and maintaining its rollup integrations (Optimism, zkSync, and others). For the details, have a look at my resume. I work mostly in Rust and Go on distributed systems: BFT consensus + blobstore, EVM, and confidential compute. Before blockchain, I did academic research in robotics, developing Koopman-based control algorithms for self-driving cars and quadrotors. I completed my Master’s degree at the Montreal Institute for Learning Algorithms (MILA), where I developed Bayesian optimization algorithms for neurostimulation, and before that earned my bachelor’s in mathematics and computer science at McGill University. Paper: https://www.cs.virginia.edu/~evans/cs551/saltzer/ Title: What Saltzer & Schroeder knew in 1975 about the agents we're building in 2026 Supporting Papers: Hardy, The Confused Deputy (1988) · Miller, Yee & Shapiro, Capability Myths Demolished (2003) Outline: Every discussion of sandboxing AI agents starts with the wrong noun. Container or microVM? gVisor or WASI? Those choices answer where computation happens. They say nothing about what authority that computation can exercise — and an agent inside a perfectly isolated VM can still exfiltrate your source through an allowed API, spend your cloud credentials, or push to main. Saltzer and Schroeder framed the real problem fifty years ago, with three of their eight design principles directly relevant to agent sandboxing problem: 1. Complete mediation turns out to be the whole reason an LLM proxy counts as security rather than decoration: the sandbox is enforcement only if the workload cannot route around it. 2. Least privilege is where agents genuinely break the classical model, because an agent's useful authority changes with its plan — authority becomes a runtime protocol, not a static profile. 3. Saltzer and Schroeder warned that a protection mechanism people find annoying will be circumvented by the people it protects. Fifty years later, the most popular sandbox configuration in the industry is --dangerously-skip-permissions. To close, a detour through Hardy's two-page note from 1988. Prompt injection is not a new vulnerability class — it's the confused deputy with a natural-language calling convention, and an LLM is the perfect confused deputy: maximally helpful, broadly authorized, and structurally unable to tell a request from data. The fix Hardy proposed is the fix Google's CaMeL rediscovered in 2025. 6:30pm - Doors 7:00pm - Speaker begins PwL curate a repository of papers and places to find them. Contributions welcome via PR. Join the PWL Discord and hop into the #nyc channel: https://discord.gg/B7aHhwBb8r Papers We Love has a Code of Conduct. Be good to each other and to the PWL community.