Security and Runtime Isolation

Our position. We treat a rule in a skill as a polite request and a hook as a filter for the calls it was written for, so neither is a boundary. For what must never happen, use a sandbox that limits what the agent can reach at all (A hook is not a boundary (opens in a new tab)). Every automation also needs one written sentence on the worst damage it can do, and if you cannot write that sentence, do not run it unattended (Sandbox and blast radius (opens in a new tab)).

The distinction that matters is guardrails versus guarantees. Guardrails ask the agent to comply, while guarantees operate at a level the agent cannot reach, such as kernel-level enforcement (The enabling environment).

Trust in who contributes code changes alongside trust in what the code does. AI tools make plausible low-quality contributions cheap, so open-source projects move from default trust to explicit vouching. The same models that let any engineer run a security review also find and exploit zero-days at a pace patching cannot match (Contributor trust and dual use).

Start here

• Contributor trust and dual use — How AI changes contribution trust while amplifying both attackers and defenders.

Related

• Contributor trust and dual use: how AI changes whose code you accept and who finds exploits first.
• The enabling environment: the runtime that has to own these controls.
• Security of autonomous coding agents: how a single coding agent gets turned against its user.
• Architecting agentic systems: a zero-trust posture toward every agent in the design.
• The Federated Factory at Enterprise Scale: the gateway, identity and audit controls at enterprise scale.

Resources

Security & Compliance

• AgentShield (opens in a new tab) - AI-agent security scanner that detects vulnerabilities in agent configurations, MCP servers, and tool permissions, distributed as CLI, GitHub Action, ECC plugin, and GitHub App.
• Aikido (opens in a new tab) - Application security suite combining SAST, SCA, secrets detection, cloud, and runtime protection with AI auto-fix PRs and triage to cut alert noise.
• Assessing Claude Mythos Preview’s cybersecurity capabilities (opens in a new tab) - Anthropic’s own writeup of the frontier model it withheld from general release after it autonomously found and exploited zero-days in major operating systems and browsers.
• Betterleaks (opens in a new tab) - Go secrets scanner from the Gitleaks authors that pairs regex rules with BPE token-efficiency filtering and live HTTP credential validation, covering git history, directories, and stdin plus GitHub, GitLab, Hugging Face, and S3; drop-in on an existing .gitleaks.toml.
• ChatGPT Security Prompts (opens in a new tab) - Curated ChatGPT prompts for offensive security work, including an “Absolute Mode” for direct, concise responses.
• Claude Code Security Review (opens in a new tab) - GitHub Action that runs Claude on diffs to flag injection, auth, and other vulnerabilities with cross-language contextual analysis.
• ClawPatrol (opens in a new tab) - Deno’s MIT-licensed security firewall that mediates traffic between AI agents and production systems, applying HCL-based rules at the wire level to block destructive commands.
• ComplyDo (opens in a new tab) - Compliance platform that maps regulations (DORA, NIS2, GDPR) against internal controls, policies, and evidence into a compliance graph to surface gaps and hold audit readiness.
• Defending Code Reference Harness (opens in a new tab) - Anthropic’s MIT-licensed reference implementation for autonomous vulnerability discovery and remediation on C/C++ libraries via a seven-stage pipeline; published unmaintained, Claude Security is the managed alternative.
• Fence (opens in a new tab) - MIT Rust GitHub Action hardening CI jobs with deny-by-default egress filtering, an audit mode, and runner lockdown disabling passwordless sudo and Docker; early development.
• Ghostty Vouch integration (PR #10559) (opens in a new tab) - First production rollout of the Vouch/Denouncement model in an OSS project (merged 2026-02-15), adding .github/vouch/, AGENTS.md, and AI_POLICY.md after AI-generated low-quality contributions broke OSS default-trust.
• Guardrails AI (opens in a new tab) - Open-source Python framework that adds input and output validation and safety guardrails to LLM applications.
• Hey Jude (opens in a new tab) - Privacy gateway for legal LLM workflows that strips PII before prompts leave your environment and restores it in responses, fully local by default via Ollama.
• LaneKeep (opens in a new tab) - Governance layer for AI coding agents that intercepts every tool call through a 9-tier pipeline, enforcing rules and budgets via a Claude Code PreToolUse hook.
• MALUS (opens in a new tab) - “Clean Room as a Service” that re-implements npm packages from public docs under the MalusCorp-0 license to strip AGPL and attribution obligations; priced per KB.
• Mobb (opens in a new tab) - Automated vulnerability remediation platform that ingests SAST and SCA findings and generates verified code fixes as PRs without uploading source code; free open-source Fixer included.
• NeMo Guardrails (opens in a new tab) - NVIDIA’s open-source toolkit for adding programmable safety and topic rails to LLM conversational apps.
• Onyx Security (opens in a new tab) - Enterprise control plane for AI agents covering discovery, policy enforcement, shadow-AI visibility, and ROI tracking across SaaS, cloud, and endpoints.
• OpenAI Guardrails (opens in a new tab) - OpenAI’s Python library for adding configurable safety and validation guardrails to agent workflows.
• Protum (opens in a new tab) - Self-hostable AI governance OS that ships compliance with your agents, automating policy, assessment, and Trust Records against Singapore frameworks (MAS, IMDA, PDPA).
• Rubrik (opens in a new tab) - Cyber resilience suite for data, identities, and workloads, paired with Rubrik Agent Cloud for AI agent governance and Agent Rewind that undoes destructive agent actions.
• Security Scanning Skills (opens in a new tab) - Claude Code skill pack for security work covering attack-tree construction, SAST configuration, STRIDE analysis, threat-mitigation mapping, and security-requirement extraction.
• SynthAPT (opens in a new tab) - Adversary simulation framework that replays attack paths from JSON playbooks, with a TUI editor and a Claude agent that turns natural language into playbooks.
• Mobb (opens in a new tab) - AI code observability platform that tracks which code was AI-generated, by which agent or model, and with what prompts, giving leaders audit trails.
• Vouch (opens in a new tab) - Forge-agnostic trust gate for OSS contributions where maintainers vouch for users via an “lgtm” comment and bad actors get “denounced”, enforced through a Nushell CLI.
• Walled AI (opens in a new tab) - Enterprise governance layer that masks sensitive data, blocks prompt injections, and validates outputs across any LLM at sub-30ms latency, deployable on-premises.
• Zero Trust for AI Agents (opens in a new tab) - Anthropic’s security framework for autonomous agents: least agency, the impossible-versus-tedious design test, three capability tiers, and an implementation workflow.
• Zero Trust Architecture (NIST SP 800-207) (opens in a new tab) - The standard the agent frameworks build on; the source of the trust-nothing, verify-everything, assume-breach premise.
• deepsec (opens in a new tab) - Vercel Labs’ agent-powered vulnerability scanner for large codebases that fans work across parallel workers, resumes interrupted runs, and supports distributed scans on Vercel Sandbox microVMs.
• nono (opens in a new tab) - Kernel-enforced sandbox for AI coding agents written in Rust, using OS-level isolation (macOS Seatbelt, Linux Landlock) to restrict filesystem, network, and dangerous commands.

Cloud Native

• K8sGPT (opens in a new tab) - AI assistant that diagnoses Kubernetes cluster issues and suggests fixes from inside the cluster.
• Metoro (opens in a new tab) - SRE product for Kubernetes that detects incidents, root-causes from live traffic, verifies deployments, and proposes fixes alongside APM, logs, and infrastructure monitoring.
• Render (opens in a new tab) - Cloud hosting for web services, static sites, cron jobs, background workers, and managed databases with Git-driven deploys and autoscaling.
• kagent.dev (opens in a new tab) - Open-source framework for DevOps and platform teams to run AI agents inside Kubernetes for operations and troubleshooting.

Data Infrastructure

• Anythink CLI (opens in a new tab) - Open-source .NET CLI for the Anythink headless backend, managing entities, data, workflows, users, files, and Stripe payments with multi-project support, OAuth, and an MCP server.
• CocoIndex (opens in a new tab) - (cocoindex.io (opens in a new tab)) Incremental data framework (Python API, Rust core) that builds context for long-horizon agents and RAG via change-data-capture, real-time indexing, and semantic search.
• Convex (opens in a new tab) - Reactive backend-as-a-service with real-time sync, ACID transactions, server functions, scheduled jobs, file storage, and full-text search in a single TypeScript-native stack.
• Dolt (opens in a new tab) - SQL database with Git-style branching, merging, diffing, and cloning over data, fully MySQL-compatible.
• DuckLake (opens in a new tab) - Open table format that keeps metadata and data in one DuckDB database with ACID transactions and time travel, removing the need for a separate catalog.
• Kreuzberg (opens in a new tab) - (kreuzberg.dev (opens in a new tab)) Document intelligence framework with a Rust core that extracts text, metadata, images, tables, and structure from PDFs, Office docs, and 97+ formats.
• MinerU (opens in a new tab) - Document parser converting PDFs, Office files, and images into LLM-ready markdown and JSON via a VLM plus OCR engine; custom Apache 2.0-based license (formerly AGPLv3).
• PostHog (opens in a new tab) - Open-source product analytics platform bundling event and web analytics, session replay, feature flags, experimentation, and a SQL-queryable data warehouse; self-hostable or managed with usage-based pricing.

Sandboxes & Dev Environments

• Agent Flywheel (opens in a new tab) - Open-source script that turns a fresh cloud server into a coding-agent host preloaded with Claude Code, Codex, Gemini, and 30+ developer tools.
• AgentBox (opens in a new tab) - Generates an opinionated devcontainer preconfigured for Claude Code.
• Agents CLI Sandbox (opens in a new tab) - Containerized environment for running the Claude Code CLI in isolation.
• CachyOS (opens in a new tab) - Performance-tuned Arch Linux distribution with CPU-specific package builds and kernel scheduling tweaks.
• Claude Docker (opens in a new tab) - Docker container that runs Claude Code with full permissions, pre-wired MCP servers, and Twilio notifications.
• ClaudeBox (opens in a new tab) - Docker image and profiles for running Claude Code in a reproducible container with preset development stacks.
• Coder (opens in a new tab) - Self-hosted cloud development environments with controls for running AI coding agents at scale: agent permissions, audit logging, and compliance.
• Daytona (opens in a new tab) - Open-source infrastructure for AI-generated code with Python and TypeScript SDKs that spawn isolated Linux sandboxes in milliseconds; self-hosted or managed.
• Dev Containers Spec (opens in a new tab) - Open spec for using a container as a full development environment, behind VS Code Dev Containers and GitHub Codespaces.
• E2B (opens in a new tab) - Cloud sandboxes on Firecracker microVMs for AI agents, with sub-200ms startup, 24-hour sessions, and multi-language runtimes; used by Perplexity and Hugging Face.
• Hyperlight (opens in a new tab) - Apache-2.0 lightweight virtual machine manager in Rust that runs untrusted code in micro-VMs with millisecond startup, embedding directly into host applications; CNCF sandbox project, pre-1.0.
• LLM Sandbox (opens in a new tab) - Python library that runs LLM-generated code in Docker, Kubernetes, or Podman with multi-language support, resource limits, artifact extraction, container pooling, and an MCP server.
• LiteLLM Agent Platform (opens in a new tab) - Self-hosted BerriAI infrastructure for running coding agents in isolated Kubernetes sandboxes, with a credential vault giving agents stub credentials while hiding real API keys.
• Modal Sandboxes (opens in a new tab) - Proprietary paid cloud service for running isolated containers that execute agent and RL code at scale, with sub-second scheduling, 100k+ concurrent sandboxes, and per-second billing.
• Mole (opens in a new tab) - GPL-3.0 macOS maintenance CLI in Shell and Go that consolidates cleaning, app uninstall, disk analysis, and live performance monitoring, replacing several paid apps.
• Omarchy (opens in a new tab) - Opinionated Arch Linux + Hyprland setup for developers.
• OpenSandbox (opens in a new tab) - General-purpose sandbox platform for AI applications with multi-language SDKs and isolation via gVisor, Kata Containers, or Firecracker; Apache 2.0, listed in the CNCF Landscape.
• Projects.dev (opens in a new tab) - CLI from Stripe for provisioning hosting, databases, auth, AI, and analytics from one place, with centralized credentials and configs portable across machines, teams, and agents.
• Sandcastle (opens in a new tab) - MIT TypeScript library that orchestrates coding agents in isolated Docker, Podman, or Vercel sandboxes via sandcastle.run(), with branch strategies that merge agent commits back.
• Sprites (opens in a new tab) - Hardware-isolated Firecracker VMs for running AI agents and untrusted code, with persistent filesystems, checkpoint/restore, and pay-per-use billing.
• cplt (opens in a new tab) - MIT Rust sandbox wrapper that runs coding agents (Copilot, OpenCode, Gemini, Pi) under kernel enforcement (macOS Seatbelt, Linux Landlock) so they cannot read secrets or exfiltrate via egress.
• exe.dev (opens in a new tab) - Persistent cloud Linux VMs with flat $20/month pricing, for developers and AI agents needing a deployable runtime; bundles Shelley, its own AI coding agent.
• just (opens in a new tab) - Make-style command runner focused on running project commands, with recipe parameters, dotenv loading, and shell completion across platforms.