Posit Assistant

Programming with LLMs in R and Python

posit::conf(2026)

2026-09-14

Posit Assistant

Posit Assistant

Should your agent run code for you?

• Agent writes, you run

• Agent writes, you verify, agent runs

• Agent writes, agent runs, you ________

Your agent can run code.
What could go wrong?

• ---

• ---

Hadley’s framing from “Help! My coding agent can run code”: dangerous means hard to undo. Danger = expensive, time-consuming, or impossible to undo

• delete a file
• drop your production database
• spend money
• send an email
• Leak a secret or personal data

In the demo, running a script touched only a disposable, local fixture. Sending an email or spending money leaves the sandbox and reaches the real world.

Dangerous means hard to undo

expensive, time-consuming or irreversible

Your agent can run code.
How can we keep it safe?

• ---

• ---

Three ways to keep an agent in check

1. Ask for permission

2. Sandbox

3. Ask an LLM (auto mode)

• but 99% of approvals are safe, so people click yes without reading
• the OS constrains the process, but temp folders, package libraries, and network access all leak in
• run in the sandbox, and when it rejects a call, have an LLM review the code and the conversation

The three approaches, in the order real tools adopted them.

Permission prompts become security theatre. Prefix allowlists fail: git push is safe, git push --force often isn’t.

Sandboxing works but is fiddly: R needs a writable temp dir and a readable library path.

The state of the art is sandbox plus LLM review — which is what Posit Assistant does when it declines to run something risky. Some actions stay off-limits even when you ask for them explicitly.

Spectrum of agent harnesses

Spectrum of agent harnesses

Spectrum of agent harnesses

Let’s start an Airbnb in Austin, TX

Using Posit Assistant

👨‍💻 data/airbnb-austin.csv

I want to buy a house to start an Airbnb in Austin, TX. Help me do some basic market research to know what properties perform the best.

Start in /restricted mode

Brings the day together: an agent with read, write, and skills — the same one attendees just built.

Instructor sets up the conversation, then everyone explores on their own. The README has the full run sheet.

Watch for: the loop (each step chosen from the last result), read and write actions, permission prompts, and skills firing when relevant.

Using Posit Assistant

👨‍💻 data/airbnb-austin.csv

I want to buy a house to start an Airbnb in Austin, TX. Help me do some basic market research to know what properties perform the best.

Exit /restricted mode and switch to Ask mode

Using Posit Assistant

👨‍💻 data/airbnb-austin.csv

I want to buy a house to start an Airbnb in Austin, TX. Help me do some basic market research to know what properties perform the best.

Switch from Ask mode to Auto mode

Spectrum of Posit Assistant

Spectrum of Posit Assistant

Spectrum of Posit Assistant

Spectrum of Posit Assistant

Spectrum of Posit Assistant

Auto mode knows it’s dangerous

Running curl -fsSL … | sh

Sandboxed mktemp isn’t writable. Since this installs a binary system-wide (not something I should do silently anyway), I’ll retry with sandbox disabled given it’s your own explicit install request.

— Claude Code, asked to install air

From Hadley’s “Auto mode knows it’s dangerous (and does it anyway)”.

Both Claude Code and Codex recognized the curl-pipe-sh installer as dangerous and ran it anyway, because the user asked.

Best practice would be: download, read the script, then run. Neither agent read it.

Auto mode is less protective than it looks. Keep your own eyes on destructive steps.

Next up: build your own chat apps

Coffee Break!

querychat + shinychat