FencedBox: the on-prem appliance that lets outsourced teams run coding agents without client code ever leaving the building

The problem

Client contracts increasingly forbid feeding proprietary code to cloud AI tools, and the failures are public: Samsung banned generative AI company-wide in 2023 after engineers leaked source code, and in October 2026 researchers showed GitHub Copilot CLI exfiltrating .env secrets via encrypted prompt injection. Outsourced and staff-augmentation firms are stuck: ban AI and lose velocity, or use it and breach client NDAs.

The idea

Why now

Three radar launches in 48 hours make this newly buildable: Capsem, Google's Rust hypervisor sandbox for AI coding agents (Oct 15); Telperion's 4x KV-cache compression for Qwen3.8-27B (Oct 15); Janas, which runs LLMs bigger than RAM from SSD (Oct 14). And the Oct 6 Adversa disclosure of Copilot CLI secret exfiltration just made cloud agents on client code radioactive for vendor-risk teams.

What it combines

capsem-google-s-rust-hypervisor-sandbox-for-ai-coding-agents (hypervisor isolation) + telperion-qwen3-8-27b-mla-gla-4x-kv-cache-compression-for-qwen3-8-27b (local frontier-class inference) + janas-run-llms-bigger-than-your-ram-from-ssd (SSD offload so a 27B model runs on appliance hardware) + autotrust-jev-35b (calibrated egress allow/deny). The mix matters because sandboxing alone cannot stop an agent from phoning home; only the judgment gate on egress turns isolation into provable compliance.

MVP

Weekend MVP: a signed VM image with a Firecracker sandbox running one coding agent, a local Qwen3.8-27B with Telperion KV compression, and a Jev-gated egress proxy that logs every outbound connection with allow/deny verdicts. Deliberately skip: physical hardware, multi-tenant management, and the tamper-evident ledger (start with append-only signed logs).

How it makes money

The moat

Microsoft/GitHub monetize cloud tokens and Copilot seats; an appliance that removes client code from their cloud cannibalizes that revenue, and they would have to become a hardware/appliance vendor and rebuild their agent stack for offline hypervisor execution, which fights their Azure growth story. E2B, Daytona and Modal are cloud-native multi-tenant businesses; on-prem appliances destroy their unit economics.

Distribution

Sell to the client side, not the dev shop: enterprises whose vendor contracts mandate data residency (banks, healthcare) buy FencedBox for their approved vendor panel, and vendors adopt it as the price of the contract. Second channel: MSP and VDI resellers who already sell compliance appliances.

Why it wins

E2B, Daytona and Modal sell cloud sandboxes, so code still sits on third-party infrastructure and fails client data-residency clauses. VDI keeps data on-prem but gives developers a 1990s terminal, not an agent. FencedBox is the first agent-native, on-prem appliance with provable egress control.

Risks

Biggest risk is hardware economics: appliance margins and support burden can kill an indie. De-risk by shipping the signed VM image first on the customer's own servers (zero hardware), proving the wedge before ever building hardware.

Build it with

• Capsem — Google's Rust hypervisor sandbox for AI coding agentshypervisor-level isolation primitive for the agent runtime
• Telperion Qwen3.8-27B-MLA/GLA: 4x KV-cache compression for Qwen3.8-27Bmakes a 27B-class model fit appliance hardware
• Janas: run LLMs bigger than your RAM from SSDSSD offload so the model runs on commodity appliance disks
• autotrust JEV-35B: 35B-A3B open decision model with calibrated probabilitiescalibrated allow/deny verdicts on every egress action

Repo to start from

fencedbox: open-core repo with the sandbox runtime, the egress gate, and the audit-log format; appliance firmware and the management console stay closed.

Evidence

• Samsung bans staff AI use after ChatGPT data leak (Bloomberg via Moneyweb)
• Adversa: Cryptographic Context Injection against GitHub Copilot CLI
• AI Agent Sandboxes Compared: 15 Providers (Upstash, 2026)
• E2B vs Modal vs Daytona: AI Sandbox Pricing 2026