This is an imperfect, incomplete collection of solutions, tools, protocols and techniques to help secure where agents run, with entries across the following categories:
- Sandboxing & Isolation: ensure agents are isolated from each other, and the interfaces through which they interact with other systems are supervised and constrained
- Provenance, Instrumentation & Observability: ensure a privileged supervisor and/or a transparency log can prove or vouch for actions that agents are taking
- Secrets Management & Isolation: ensure the agents and their potentially untrusted inputs, can never see the secrets they need (whcih are facilitated by a privileged component)
- Agent Identity & Credentials: help assign a credential to the agent that ideally binds the other security properties and allows the agent to continuously prove integrity and intent to other parties
- References and further reading
What this list is not: entries that are about security at runtime (as opposed to security of the runtime), entries where the isolation relies on a shared kernel or a parent process supervisor in the same privilege level (Linux namespaces, process-based isolation), and entries that cover more general AI security topics (e.g., XPIA) are not a great fit for this list (there may be for other awesome lists!) because we focus squarely on isolation, sandboxing, attestable/transparent observability, secrets/credential isolation, workload identities, and AuthNZ protocols that put all of this together. We may still refer to such entries if some of their capabilities are illustrative for this problem space.
| Name | Keywords | Description |
|---|---|---|
| 🔥 nono | Landlock, secret isolation, integrity | Combines Landlock isolation with integrity-protected configuration and OS-native secrets management. See also kubefence, an NRI plugin that transparently injects nono sandboxing into Kubernetes containers and Kata VMs. |
| 🔥 e2b | Firecracker, MicroVM | Cloud-based agent sandbox infrastructure using Firecracker MicroVMs for strong hardware-level isolation between agent workloads. |
| 🔥 Zeroboot | Firecracker, MicroVM, CoW snapshots | Sub-millisecond VM sandboxes via Firecracker, each fork is a real KVM VM with hardware-enforced memory isolation. No networking inside forks (serial I/O only). |
| 🔥 forkd | Firecracker, MicroVM, CoW snapshots | MicroVM sandbox runtime for agent fan-out. Diff-snapshot chains layer memory images like container layers. Per-child network namespaces, Python/TypeScript/MCP SDKs. |
| 🔥 Beams | Firecracker, MicroVM, agent credentials, secrets isolation | Teleport's agent runtime using Firecracker with delegated short-lived identity certificates, zero secrets in the sandbox, policy-controlled egress proxy, and inference endpoint routing that injects backend credentials without exposing API keys to the agent. |
| 🔥 Umbra | Intel TDX, confidential VMs, attestation, secrets isolation | Separates each agent into a CVM that forces egress through an independently attested Security CVM that enforces policy and DLP and injects credentials outside the sandbox. (Security CVM image/runtime measurement pinning is temporarily disabled) |
| 🔥 krunai | KVM, libkrun, MicroVM, gVisor | Purpose-built agent sandbox running AI agents inside libkrun KVM microVMs, transparent user-space networking via gVisor netstack. |
| 🔥 stereOS | QEMU, KVM, Nix, gVisor, secrets isolation | Purpose-built NixOS for AI agents, support for QEMU/KVM with sub-3s boot, gVisor included for in-VM sandboxing, and vsock-based secret injection via tmpfs. See also agentd. |
| 🔥 capsem | Apple Virtualization, integrity | macOS-native sandbox running agents in Linux VMs via Apple Virtualization.framework. Hardened kernel with no IP stack and no loadable modules, read-only rootfs, BLAKE3 boot asset integrity, no systemd. |
| 🔥 Docker Sandboxes | Linux namespaces, cgroups, MicroVM | Docker's purpose-built sandbox for coding agents. See also NanoClaw on Docker Sandboxes for micro VM-based per-agent isolation. |
| 🔥 Anthropic's sandbox-runtime | Linux namespaces, seccomp, bubblewrap | Anthropic's experimental agent sandbox combining Linux namespaces and seccomp filters via bubblewrap for process-level isolation. |
| 🔥 matchlock | Firecracker, MicroVM, gVisor, secrets isolation | CLI and multi-language SDK for running agents in ephemeral Firecracker microVMs with host-boundary secret injection through a MITM proxy. |
| 🔥 Cleanroom | Firecracker, MicroVM, secrets isolation | Buildkite's self-hosted agent sandbox using Firecracker with host-side gateway credential injection and digest-pinned OCI images. |
| 🔥 microsandbox | KVM, libkrun, MicroVM, ecrets isolation | MicroVM sandbox for AI agents using libkrun with secret protection so credentials never enter the VM, Rust/Python/TypeScript SDKs |
| 🔥 CubeSandbox | KVM, RustVMM, MicroVM, secrets isolation, CoW snapshots | Hardware-isolated sandbox service for AI agents built on RustVMM + KVM with credential vault (keys never enter sandbox), CoW snapshot/clone/rollback, auto-pause/resume, and E2B SDK-compatible. |
| 🔥 boxlite | KVM, libkrun | Lightweight VM-based sandbox for coding agents using KVM virtualization via libkrun, providing strong hardware-enforced isolation. |
| 🔥 brood-box | KVM, libkrun, MicroVM, CoW snapshots | CLI for running AI coding agents (Claude Code, Codex, OpenCode) inside libkrun KVM microVMs with COW snapshot isolation, DNS-aware egress policies, and Cedar-based MCP authorization. Built on go-microvm. See also waggle, an MCP server exposing sandboxed code execution in disposable microVMs. |
| 🔥 Agent Sandbox (k8s) | gVisor, Kata | Kubernetes SIG project combining gVisor and Kata Containers for sandboxing AI agents in cloud-native environments. See also Agent Substrate. |
| 🔥 OpenSandbox | gVisor, Kata, Firecracker, Docker, Kubernetes | Alibaba's general-purpose sandbox platform for AI agents with multi-language SDKs, per-sandbox egress controls, ingress gateway, and secure container runtimes (gVisor, Kata, Firecracker). |
| 🔥 Cloudflare Computer | V8 isolates, capabilities | Agent runtime combining fresh Dynamic Worker isolates with VM-isolated containers. Supports intercepted egress; isolate execution constrains host capabilities, filesystem paths and capability calls. |
| 🔥 Forky Pig | Firecracker, KVM, MicroVM | Hardware-isolated microVMs with whole-GPU passthrough. Built on Porker, a Firecracker hard fork adding VFIO PCI passthrough while retaining its jailer and seccomp architecture. |
| 🔥 Gondolin | MicroVM | TypeScript/Node.js agent sandbox using QEMU micro-VMs. See also the security design and repo. |
| 🔥 k7 | Kata, MicroVM | Agent isolation platform using Kata Containers to add MicroVM-backed security boundaries to agent execution. |
| 🔥 Hyperlight + Nanvix | MicroVM, sandboxing, secrets isolation | Hardware-isolated VMs via KVM or Hyper-V with millisecond cold starts and no guest OS — combined with host-side syscall interposition for 150+ syscalls via the Nanvix Rust microkernel. See also hyperlight-sandbox (Python SDK) and HyperAgent, an agent runtime that runs LLM-generated JavaScript handlers inside Hyperlight micro-VMs. |
| 🔥 agentOS | seL4, capabilities, agent credentials | Real bootable OS on the seL4 microkernel designed for AI agents. Agents run in hardware-enforced isolated address spaces with unforgeable capability tokens (ToolCap, ModelCap, NetCap, SpawnCap); capabilities are delegatable but never escalatable. Ed25519 identity is badged at the kernel IPC level. seL4 runs at ARM EL2 as the hypervisor. Alpha; boots on QEMU AArch64/x86_64. |
| 🔥 Authority Nanos | unikernel, WASM, capabilities, sandboxing | Unikernel-based agent execution environment built on Nanos with 14 custom syscalls for agent communication and a secondary WASM sandbox for capability-gated tool execution. |
| 🔥 Leash | eBPF, Linux namespaces | Wraps AI coding agents in containers and enforces Cedar policies via eBPF LSM programs scoped to the agent cgroup plus credential injection via header rewriting. |
| 🔥 secimport | eBPF, bpftrace, seccomp, nsjail | eBPF-based module-level Python sandbox that uses USDT probes to track which Python module is executing at each syscall boundary and nsjail seccomp profile generation. |
| 🔥 sandlock | Landlock, seccomp, eBPF, CoW snapshots | Process sandbox combining Landlock (filesystem + network + IPC), seccomp-bpf (syscall filtering). See also the architecture blog post. |
| 🔥 ironclaw | WASM, Linux namespaces, secrets isolation | WASM-sandboxed tools (capability-based permissions, endpoint allowlisting), host-boundary credential injection where secrets never enter WASM memory. |
| 🔥 amla-sandbox | WASM, capabilities, sandboxing | WASM-based agent sandbox using wasmtime with a capability-based security model that enforces per-tool method constraints, call limits, and parameter validation before any tool invocation leaves the sandbox. |
| 🔥 OpenFang | WASM, agent credentials | Uses a WASM dual-metered sandbox: wasmtime with both fuel metering and epoch interruption, backed by a watchdog thread that force-kills runaway code. Seeks to implement information flow taint tracking (secrets labelled from source to sink), Ed25519-signed agent manifests, and other techniques. |
| 🔥 cua | Linux namespaces, QEMU | Computer-use agent SDK using Linux containers and QEMU-inside-Docker for full desktop environment isolation. See also the qemu-docker library. |
| goose + boxlite discussion | KVM, libkrun | GitHub issue discussing integration of boxlite KVM-based sandboxing into Block's goose agent framework. |
| smolVM | KVM, libkrun, MicroVM | MicroVM sandbox using libkrun and KVM with <200ms boot, network off by default, and a pack command that builds portable single-binary VMs. |
| Freestyle | KVM, MicroVM | Managed agent-scale sandbox infrastructure: full Linux KVM VMs (not containers) with nested virtualization, real root access, sealed multi-user isolation inside each VM, git repos per agent with bidirectional GitHub sync, scales to 10k+ concurrent agents. |
| kvm-jailbox | QEMU, KVM, libvirt | Persistent per-project development VMs for coding agents on a plain libvirt/KVM stack, device model is stripped (no graphics, USB, balloon, virtio channels, TPM, nested virt) to shrink VM-escape exposure. See the configuration guide. |
| Confidential Agents | SEV-SNP, TEE, attestation | Managed Confidential VM service for AI agents: AMD SEV-SNP hardware TEE isolation (host cannot inspect memory), attestation chain verifying hardware + TPM + inference gateway. Open-source verification CLI. |
| Sprites | Firecracker, MicroVM, CoW snapshots | Fly.io's managed Firecracker-based persistent Linux VMs for running coding agents or arbitrary code; checkpoint/restore in ~300ms, pre-installed with Claude Code and Codex CLI, API and CLI access. |
| Katsuobushi Sandbox | microvm,nix, QEMU, KVM | Hermetic NixOS microVM (microvm.nix/QEMU) with default-deny network. Agent mode drives a long-lived Claude Code session inside the VM via vsock; secrets injected via QEMU fw_cfg. Work exits only via git push. |
| Tarit | rust-vmm, KVM, MicroVM, CoW snapshots, secrets isolation | Open-source KVM microVM platform for AI agents: rust-vmm based VMM with minimal device model (MMIO virtio), demand-paged guest RAM, live snapshots with CoW/reflink, vsock exec/PTY. Powers InstaVM (managed service with default-deny egress and proxy-based secret injection). |
| Unikraft Cloud Sandboxes | unikernel, MicroVM | Managed unikernel-based microVM sandboxes with millisecond boot. Built on the open-source Unikraft unikernel framework. |
| urunc | unikernel, containerd, QEMU, Firecracker, Cloud Hypervisor | Generic OCI unikernel runtime — containerd shim that packages unikernels as container images and runs them on multiple VMMs (QEMU, Firecracker, Cloud Hypervisor, Solo5) or seccomp-based monitors. Source. |
| tilde.run | Linux namespaces | SaaS agent sandbox with a versioned POSIX filesystem (mounting code from GitHub, data from S3, documents from Drive as a single ~/sandbox), container-isolated runs with atomic commit-on-clean-exit/rollback-on-failure semantics, network policy with per-outbound-call audit log, and human approval gates. |
| Declaw | Firecracker, MicroVM | Security-first agent sandbox platform using Firecracker microVMs with per-sandbox network policy (egress filtering, domain allowlists), built-in guardrails (PII scanning, prompt injection defense, toxicity), audit logging, and Python/TypeScript/Go SDKs. Managed cloud or self-hosted. |
| Isorun | MicroVM, secrets isolation, CoW snapshots | Managed microVM sandboxes with per-sandbox egress allow/deny lists, credential injection, audit logs, and a fork primitive that clones running VM state (filesystem + memory + processes) for agent branching. TypeScript SDK with OpenAI Agents, LangChain, MCP server, and Claude Managed Agents integrations. |
| clampdown | Landlock, seccomp, Linux namespaces, SELinux, AppArmor | Hardened container sandbox with zero-capability agent (cap-drop=ALL), Landlock V3 filesystem isolation, ~115 blocked syscalls via seccomp, mandatory OCI hooks enforcing security policy on every tool container the agent spawns and SELinux/AppArmor confinement. |
| cplt | Landlock, seccomp, Seatbelt | Kernel-enforced sandbox for AI coding agents. macOS: Apple Seatbelt/SBPL; Linux: Landlock LSM + seccomp-BPF. Policy is bound to the repository. Command-level guards on git and gh. Single static binary, no Docker required. |
| Kern | Linux namespaces, seccomp, cgroups | Runtime for per-call execution of agent-generated code. The untrusted profile combines user/PID/mount/network/UTS/IPC namespaces, a deny-by-default seccomp allowlist, cap-drop ALL, read-only rootfs, network-off default, and cgroup limits; --require-limits refuses to run when limits cannot be enforced. Shared kernel. |
| Cordium | agent credentials, Linux namespaces, cgroups | Runs agent workloads in nested rootless Podman containers with Linux user namespaces, seccomp, and cgroup limits. Each workspace receives an Octelium Session identity for deny-by-default, per-request L7 authorization and proxy-time injection of HTTP, SSH, database, Kubernetes, and mTLS credentials. Shared kernel. |
| landstrip | Landlock, Seatbelt, AppContainer | Cross-platform sandbox CLI using Landlock on Linux, Seatbelt on macOS, and LPAC AppContainer on Windows. Accepts Anthropic's Sandbox Runtime JSON as the policy format. |
| Agent Safehouse | Seatbelt | Deny-first macOS sandbox for entire coding-agent process trees, credential stores. |
| IronCurtain | V8, Linux namespaces, bubblewrap | Multi-layer agent sandbox: Code Mode runs TypeScript in a V8 isolate with zero host access, Docker Mode runs external agents (Claude Code, Goose) in network-disabled containers. Plain-English constitution compiled into deterministic policy rules enforced on every MCP tool call, plus bubblewrap-sandboxed MCP servers. |
| Ephemora Cell | WASM, WASI, capabilities | Capability-based runtime for untrusted agent code and MCP tools. JCS-canonicalized sign-ready execution records. |
| monty | capabilities | Minimal secure Python interpreter written in Rust for running LLM-generated code with no host access by default — filesystem, network, and env are only available via explicitly provided external functions, with sub-microsecond startup and serializable execution state. |
| secure-exec | V8 isolates | V8 isolate-based Node.js sandboxing. Bridges real Node.js APIs (fs, http, child_process) into the isolate. |
| Minimal | Linux namespaces, Landlock, seccomp, SLSA, SBOM, attestation | Local-first hermetic environments for developers and agents. Linux namespace isolation via hakoniwa (Rust; MNT+pivot_root, PID, NET+pasta, cgroups v2, Landlock, seccomp), SLSA Build L3 attestation, CycloneDX v1.5 SBOMs with VEX. |
| yolo-cage | Linux containers | Agents run in K8s pods inside a Vagrant VM, with a git dispatcher that enforces per-branch isolation, a fail-closed mitmproxy egress proxy with LLM-Guard secret scanning and GitHub API operation blocking, TruffleHog pre-push hooks, and Kubernetes NetworkPolicy. |
| 🔥 code-on-incus | Incus, nftables, seccomp, AppArmor | Incus system containers with active threat detection: kernel-level nftables monitoring for reverse shells/C2 connections, DNS tunneling, credential scanning and isolation, network isolation, JSONL audit logging. |
| OpenShell | Linux containers, libkrun, MicroVM, secrets isolation | NVIDIA's agent sandbox runtime with pluggable compute backends including experimental per-sandbox libkrun MicroVM runtime for stronger isolation. See also compute runtimes architecture. |
| Omnigent (Omnibox) | secrets isolation | Databricks' open-source meta-harness with bundled sandbox: filesystem/network isolation + credential injection across local or cloud backends (Modal, Daytona, E2B, CoreWeave, Kubernetes, OpenShell). Cedar-style policies pause for approval before risky actions. |
| MXC | Bubblewrap, LXC, Seatbelt, Hyperlight, MicroVM, Windows | Unified sandbox abstraction that selects the strongest available containment backend per platform — from OS process sandboxes up to Hyperlight/NanVix microVMs — behind a single JSON policy schema. See also Azure Container Apps Sandboxes. |
| agentcage | Podman, Lima/KVM, Apple Container, secrets isolation | Defense-in-depth proxy sandbox: inspecting proxy scans every HTTP request/WebSocket/DNS query. Secret injection (placeholders in, real values swapped outbound, redacted inbound), Shannon-entropy+regex payload scanning. Three backends: rootless Podman, Lima/KVM VMs, Apple Container microVMs (macOS 26+). |
| navaris | LXC, Firecracker | Sandbox control plane for managing isolated environments across multiple backends (LXC/Firecracker) with copy-on-write fork support and live peek into running sandboxes. |
| AgentENV | Firecracker | Firecracker microVM platform for running agent environments at scale. E2B-compatible API. |
| SmolVM | Firecracker, MicroVM | Firecracker microVM sandbox for AI agents. Read-only host mounts via virtiofs, snapshots, browser sandbox. Python SDK + CLI. |
| Stockyard | Firecracker, CoW snapshots | Firecracker VM farm with ZFS copy-on-write snapshots from pre-tool-use hooks for state rollback. Tailscale auth, ephemeral cattle VMs. |
| whim | Firecracker, MicroVM | Ephemeral MicroVM shells via AWS Lambda infrastructure with restricted capabilities by default. Go library + CLI. |
| agentsh | eBPF, seccomp, Linux namespaces | Shell shim, eBPF cgroup network enforcement (domain allowlisting, DNS interception), and seccomp-bpf with user-notify for signal interception and syscall blocking. |
| fence | bubblewrap, Landlock, seccomp, eBPF, Linux namespaces | Cross-platform agent sandbox using bubblewrap with Landlock, seccomp, and eBPF monitoring on Linux. |
| 🔥 Greywall | bubblewrap, Landlock, seccomp, eBPF, secrets isolation | bubblewrap namespaces, Landlock, seccomp BPF, eBPF monitoring, kernel-level TUN network capture, all traffic routes through greyproxy. Host-side credential substitution. Learning mode auto-generates least-privilege profiles. |
| ai-jail | bubblewrap, Landlock, seccomp, Linux namespaces, MacOS | Multi-layer agent sandbox: bubblewrap namespaces (PID/UTS/IPC/net) + Landlock V3/V4 (filesystem + network) + seccomp-bpf (~30 blocked syscalls) + resource limits. Lockdown mode mounts project read-only with no network and clearenv. Per-project TOML config. |
| xbin | Linux namespaces, seccomp | Rootless sandbox, each backend in its own user/mount/PID/IPC/UTS/net namespaces, overlay rootfs, capabilities dropped + seccomp block-list. RBAC between components (identity verified per call), policy ceilings cap grants at approval and evaluation, per-element encrypted vault. |
| rein | bubblewrap, secrets isolation | Credential broker for coding agents: bubblewrap sandbox (via srt) with no direct network egress. Agent never holds a readable credential. Write-gating via issue declaration + human confirmation, egress allowlist. |
| isolate | bubblewrap, Linux namespaces | Profile-driven bubblewrap isolation for AI agents: reuses host filesystem layout exposing only declared paths, per-project YAML profiles, sealed memfd argument passing; insightful design choices around agent data access and leakage. |
| shuru | Apple Virtualization, MicroVM, secrets isolation | macOS-primary agent sandbox using Apple Virtualization.framework with ephemeral rootfs (resets on every run), host-allowlisted egress, VirtioFS mounts with overlay (guest writes never touch host by default), and a secrets proxy that injects placeholder tokens into the VM substituting real values only on outbound HTTPS to specified hosts — secrets never enter the VM. TypeScript SDK + agent skill. |
| Isolade | MicroVM, secrets isolation | Coding agent workbench with per-agent microVM isolation, secrets never enter the VM, multi-agent parallelism with per-session isolation. |
| bhatti | KVM, libkrun, MicroVM, Apple Virtualization | MicroVM orchestrator with own VMM (libkrucible, libkrun fork): real Linux VM per sandbox (own kernel/filesystem/process isolation), sub-4ms resume from pause. Cross-platform (Linux KVM + macOS Apple Silicon). |
| workcell | Apple Virtualization, Colima | Dedicated Colima VM + hardened container for coding agents on Apple Silicon. Explicit TOML injection policy for credentials. Non-root by default, signed-range verification, lower-assurance paths explicitly labeled. |
| vmoat | Colima, KVM, Apple Virtualization | One ephemeral Colima VM per git worktree — separate kernel + Docker daemon per task so a crash or prune in one worktree never touches another. Claude Code plugin auto-provisions and tests worktrees in isolation. macOS (vz+virtiofs), Linux/WSL2 (qemu+KVM). |
| agent-vm | Lima, QEMU, Apple Virtualization | Per-directory persistent Lima VM for coding agents: full VM isolation (separate kernel/filesystem), Docker + headless Chrome inside the VM. macOS + Linux. |
| virtdev | KVM, QEMU | Per-project Arch Linux KVM/QEMU VMs with nftables egress zones. |
| Locki | Lima, Incus, QEMU, Apple Virtualization | Per-agent git worktree + VM sandbox (Lima + Incus): real VM isolation with container speed. macOS + Linux. |
| Bromure Agentic Coding | MicroVM, secrets isolation | macOS (Apple Silicon) app running agents in Linux VMs with selective folder sharing. Credential stub-and-swap proxy. Human-in-the-loop approval popups before sensitive credentials are substituted. |
| clawk | Apple Virtualization, Firecracker | Disposable VM per project for coding agents. Network allow-list enforced in a userspace TCP/IP stack below the guest, ssh-agent forwarding without key exposure. |
| Gondolin | QEMU, libkrun, secrets isolation | Local micro-VM sandbox with programmable JavaScript hooks for HTTP/TLS egress policy (full request/response interception). Phantom-token secret injection. Docs. See also Tuor, a convenience wrapper with JSON config and per-project/folder settings. |
| yoloAI | Linux namespaces, Kata, gVisor, Apple Container, Seatbelt, secrets isolation | Selectable isolation tiers per sandbox (runc → gVisor → Kata QEMU/Firecracker VMs). Credential brokering keeps API keys host-side via local proxy injection. |
| dyana | eBPF | Docker-based sandbox for loading, running, and profiling untrusted files (ML models, Pickle, ELF, JS) with hardened containers (cap-drop ALL, no-new-privileges, network disabled, ipc-none, mem/pid limits, tmpfs noexec) monitored by an Aqua Tracee eBPF sidecar that traces 40+ security events (fileless execution, ld_preload, code injection, syscall hooking) scoped to the target container. |
| agentcontainers | containers, eBPF, Sigstore, SLSA | Extends devcontainer.json with agent security policy: default-deny approval broker, Aya eBPF enforcer sidecar (cgroup net hooks + LSM credential gating), OCI digest pinning, Sigstore signing, SLSA provenance, secrets via tmpfs. Fail-closed. |
| shai | containers, Linux namespaces | Agent sandbox using container isolation with a novel cellular development model for controlled agent-driven code changes, scoping changes to discrete units. |
| sandy | Docker, seccomp, AppArmor | Per-project Docker sandbox for coding agents with read-only rootfs, cap-drop ALL, no-new-privileges, seccomp+AppArmor, ephemeral credentials, per-project plugin/memory isolation (venv model). |
| Rover Sandbox | containers | Endor Labs' Rover uses Linux containers to sandbox agent tool execution within its security-focused agent framework. See also the sandbox implementation code. |
| bentorun | gVisor, sandboxing | MCP server exposing a single execute_python tool that runs each session in an ephemeral gVisor-sandboxed container on Google Cloud Run — Sentry (user-space Go kernel intercepts syscalls) + Gofer (filesystem proxy), per-session isolation, configurable package allowlist. |
| Runmesh | gVisor, eBPF | Multi-tenant sandbox execution plane for AI agents: gVisor kernel interception + seccomp + eBPF syscall filtering per sandbox, task chaining across isolated sandboxes. Go control plane, Rust node agents. |
| Containarium | LXC, eBPF | Self-hostable multi-tenant agent runtime: per-tenant LXC containers with eBPF egress policy, SSH-native access (no kube-apiserver token), KMS-envelope-encrypted secrets on tmpfs, image digest verification (pre+post-pull), SHA-256 hash-chained audit log. |
| syva | eBPF, zones, kernel-enforcement | eBPF programs loaded per node that enforce zone-based boundaries between container groups — intercepts and denies cross-zone open(), exec(), mmap(), ptrace(), and kill() at the kernel level before they happen. Potentially useful in some shared kernel scenarios. Declarative TOML policy (capabilities, memory/PID limits, network zones, filesystem paths, syscall deny list). |
| Veto (Ona) | BPF LSM | Content-addressable kernel enforcement using BPF LSM: blocks executables by SHA-256 hash of binary content (not path), pre-execution with no TOCTOU gap. The deep dive on agent evasion of path-based controls is a good read for anyone working with bubblewrap. |
| Hazmat | macOS, Seatbelt | macOS-native runtime containment for AI agents and coding-agent workflows using Seatbelt sandboxing. |
| sandvault | macOS | Each agent runs as a dedicated macOS user behind a sandbox-exec profile — no access to your home, keychain, or SSH agent. Shared workspace via git remotes. Brew-installable. |
| agentOS | WASM | Virtual OS kernel (filesystem, process table, networking) in WASM for coding agents (Pi, Claude Code, OpenCode). Deny-by-default permissions for fs/net/process, per-agent resource limits. Blog post. |
Entries about agent instrumentation for security observability, which could be useful for provenance tracking and to feed policy decision points (PDPs), including gateways, proxies, eBPF-based tools, attestation frameworks, policy engines, and tracing systems.
| Name | Keywords | Description |
|---|---|---|
| 🔥 cMCP | TEE, Cedar, attestation, MCP | Confidential MCP gateway: enforces Cedar policy inside a hardware TEE (enclave) where the governed agent cannot reach it. Policy bundle hash measured into hardware attestation report before code runs. Emits signed TRACE Claims verifiable without trusting the operator. |
| 🔥 aflock | SPIFFE, in-toto, provenance, policy | Signed policy files that constrain agent behavior and produce verifiable attestations derived from model, environment, tools, policy, and parent. Facilitates key separation, SPIFFE-modeled workload attestation, and in-toto-inspired sublayouts for delegated sub-agent constraints. |
| 🔥 cupcake | tracing | EQTY Lab's runtime security framework for agents providing signed execution traces and verifiable agent behavior guarantees. |
| 🔥 mandible | provenance | Multi-agent coordination framework with built-in cryptographic provenance: bridge attestations create linked chains of custody across environments. Seeks to implement output-level provenance and causal lineage tracking as first-class primitives. |
| 🔥 sage | observability | Hooks into agent tool calls to validate commands, URLs, file writes, and package installs against cloud-based reputation APIs, local YAML threat heuristics, and supply-chain package analysis. |
| 🔥 AgentSentinel | eBPF | Real-time defense framework for monitoring and constraining agent behavior using eBPF instrumentation. See also the research paper. |
| 🔥 AgentSight (eBPF) | eBPF | eBPF-based observability tool providing kernel-level tracing of agent runtime behavior without modifying the agent code. |
| 🔥 ActPlane | eBPF, BPF-LSM, information-flow | eBPF-based policy engine for agent harnesses: labeled information-flow rules in a compact DSL enforced at the kernel level across entire process lineage trees. Supports block/kill/notify modes with corrective feedback to the agent via hooks (Claude Code, Codex). Causal ordering (since clauses), data-flow tracking across fork/exec/file edges. From the AgentSight team. |
| 🔥 MCPGuard | eBPF, BPF-LSM, MCP | Kernel-level sandboxing for MCP tool calls: transparent proxy treating MCP servers as untrusted. Three layers — per-server capability policy, argument validation (injection detection), and BPF LSM programs (file/net/proc/fork guards) enforcing at the syscall boundary with fork tracking. 82-case benchmark, 0% FPR. |
| 🔥 IronScope | eBPF, BPF-LSM, CPython | eBPF runtime enforcement for LangChain/LangGraph tools: probes CPython frames to attribute OS-level events (file open, exec, socket connect) to the specific tool call that caused them, then enforces per-tool YAML policies via BPF LSM at the syscall boundary. Tracks context across async tasks, threads, and subprocesses. |
| 🔥 PipeLock | egress-proxy, DLP, signed-receipts | Agent firewall combining HTTP, WebSocket, MCP, A2A, and TLS-intercepted traffic inspection with optional Landlock/Linux namespace/seccomp containment. Signed, hash-chained action receipts bind decisions to policy and transport. Also see Agent Egress Bench. |
| MCPSpy | eBPF, MCP | eBPF-based real-time monitor that intercepts MCP traffic at the kernel level. Includes ML-based prompt injection detection on the wire. |
| 🔥 membrane | eBPF, Tracee, egress-filtering | Agent-agnostic sandbox with eBPF tracing (via Tracee sidecar) logging all file, network, and process activity as structured JSONL, hostname-allowlisted egress filtering with continuous DNS refresh, filesystem masking/read-only patterns, and unprivileged Docker-in-Docker via Sysbox. |
| 🔥 Claw Patrol | credential-separation, policy | Routs agent traffic through WireGuard/Tailscale tunnels: terminates TLS, parses inner protocol, injects credentials the agent never sees and evaluates HCL/CEL rules per request. Approval chains compose LLM judges and human-in-Slack. See blog post. |
| 🔥 CPEX | information-flow, policy, delegation | Rust reference-monitor runtime for AI agents: deterministic enforcement pipelines per capability (tools, prompts, A2A). Cross-operation taint propagation (labels persist across session, preventing write-down), delegation-as-policy (OAuth token exchange/Biscuit as pipeline steps), field-level redaction. Orchestrates Cedar/CEL/OPA/AuthZEN as PDPs. APL policy language. |
| Aten | eBPF, ETW | Cross-platform endpoint telemetry daemon correlating Claude Code and Codex transcripts with descendant-process activity captured through eBPF on Linux and ETW on Windows. |
| Crux | signed-receipts, MCP, capability-tokens | Local-first agent memory and retrieval daemon with Ed25519-signed CROWN receipts, BLAKE3-chained storage. Evidence covers Crux-mediated activity; agent hooks are self-reported and its optional LLM witness can be bypassed, so it does not prove all agent conduct or enforce system-wide egress. |
| tapes | proxy, OpenTelemetry, content-addressable | Transparent agentic telemetry proxy (same author as stereOS): intercepts agent↔inference API traffic, stores every session as content-addressable turns in SQLite with vector embeddings, OpenTelemetry instrumentation, deterministic replay via session checkout, and semantic search across conversation history. |
| 🔥 agentgateway | policy | Dedicated gateway for agent traffic providing centralized observability, policy enforcement, and access control at the agent boundary. |
| 🔥 rover (instrumentation) | tracing, policy, sandbox | Endor Labs' security-focused agent framework with built-in tracing, policy enforcement, and sandboxed tool execution. |
| ClawShield | eBPF, iptables, proxy, OCSF | Defense-in-depth security proxy for AI agents with optional eBPF syscall monitoring, note the cross-layer event bus that helps tighten policies across layers. |
| carapace | Cedar, LLM-proxy, MCP | Cedar policy enforcement for AI agents with an LLM proxy so the agent never holds the real API key. Gates MCP tools, shell commands, and API domains via Cedarling WASM (<6ms). See also OVID-ME, and blog post showing end-to-end flow. |
| ibac | OpenFGA, intent-parsing, policy | Intent-Based Access Control: derives per-request FGA tuples from the user's stated intent (one extra LLM call), then checks them against OpenFGA before every tool invocation (~9ms). Default-deny, no framework changes. 100% injection blocking on AgentDojo (strict mode). |
| guardians | taint-analysis | Implementation of Erik Meijer's "Guardians of the Agents". See also CaMeL . |
| hooksy | Claude Code, LLM-analysis | Claude Code hooks inspector with LLM-augmented dynamic analysis. |
| AgentTrust | MCP, LLM-judge | Real-time semantic safety interception between agent and tools. 170 YAML policy rules, <1ms rule latency. See paper. |
| Adrian | reasoning-traces, AARM, block-mode | Open-source runtime security for AI agents: analyzes both agent activity logs (tool calls, outputs) and reasoning traces (chain-of-thought) to detect malicious/misaligned behavior, and optionally intervenes in-flight (audit vs block mode). LLM-as-classifier reasons about whether actions match the agent's remit. AARM-aligned, self-hostable offline. Based on paper. |
| Prempti | Falco | Falco for AI coding agents: intercepts every tool call before execution and evaluates against customizable Falco YAML rules. Allow/deny/ask verdicts with LLM-friendly denial feedback so agents adapt. Guardrails mode (enforced) or monitor mode (observe-only). Ships curated default ruleset covering credentials, exfiltration, persistence, and MCP/skill poisoning. Cross-platform (Linux/macOS/Windows). |
| agentjail | OPA, hooks, policy | PreToolUse hook → daemon → OPA Rego policy engine. Optional kernel sandbox (agentjail-shield), credential broker with env-stripping, transparent network proxy with per-host policy and LLM traffic capture. |
| HELM AI Kernel | hooks, policy, signed-receipts, evidence | Execution boundary for AI agent actions (Claude Code, Codex, MCP tools, shell commands) that records decisions with cryptographically signed receipts. |
| logira | eBPF, cgroups | OS-level runtime auditing for AI agent runs: eBPF-based collection of exec, file, and net events with cgroup v2 run-scoped attribution. Built-in detection rules (credential access, destructive commands, persistence changes, suspicious egress, curl|sh patterns). |
| AgentLens | OpenTelemetry, DLP, detection-rules | OTel-based security observability for AI coding agents: collects telemetry via OTLP, applies YAML detection rules (secrets, DLP, shell risk, MCP risk, prompt injection), cost monitoring, CI/PR policy gates. |
| ACS | hooks, OTel, OCSF, AgBOM | Open standard for runtime agent control: platforms expose middleware hooks (input/output/tool-call/planning/memory/lifecycle), enforcement layer applies declarative policies through them. Includes Agent Bill of Materials (AgBOM) via CycloneDX/SPDX and OTel+OCSF observability mappings. |
| gryph | hooks, audit-trail | Local-first audit trail for AI coding agents that hooks into tool calls and logs every file read/write and command execution. |
| agent-trace | tracing, MCP, replay, policy | strace for AI agents: captures every tool call, file op, prompt, and response from Claude Code, Cursor, Gemini CLI, or any MCP client. Session replay, run diffs, and audit exports (Datadog, Honeycomb, New Relic, Splunk). VS Code extension + CLI. |
| Infisical Agent Sentinel | MCP, gateway, policy, audit | Infisical's centralized control plane for AI agent tool access: MCP gateway managing which tools agents can reach, how they authenticate, and full audit visibility into every tool invocation. |
| Arize Phoenix Tracing | tracing, observability | Arize Phoenix's LLM tracing framework providing observability into agent tool calls and execution flows. |
| agentry | tracing | Agent protocol implementation providing structured message tracing and policy hooks for securing agent-to-agent interactions. |
| dapr-a2a | observability | Dapr integration for Agent-to-Agent protocol providing service mesh-style observability and policy for inter-agent communication. |
| toolhive provenance | MCP, provenance, registry | Toolhive's registry architecture documenting how tool provenance and security metadata are tracked for MCP servers. |
| Virtual MCP Server (Stacklok) | MCP, provenance | Stacklok's unified gateway multiplexing multiple MCP servers with centralized policy and provenance verification via toolhive. |
| Agent Governance Toolkit | policy, OPA, Cedar, SPIFFE, SRE | Microsoft's runtime governance framework with deterministic policy enforcement (OPA/Rego + Cedar), Ed25519/SPIFFE agent identity, trust scoring, SRE tooling (SLOs, error budgets, chaos), and full OWASP Agentic Top 10 coverage. Multi-language (Python, TypeScript, .NET). See also LIMITATIONS.md. |
| Dogwood | Cedar, temporal-policy | Cedar-derived governance language for agent tool calls adding temporal conditions (since, formerly, windowed aggregations) over event history. See AgentCore Policy. |
| micromize | eBPF, BPF-LSM, IMA, execution-integrity, Kubernetes | BPF-LSM enforcement of container boundaries built on Inspektor Gadget. Execution integrity via SBOM + runtime binary hash validation using bpf_ima_file_hash. |
| SourceryKit | zero-knowledge, source-of-truth, egress, MCP, allowlist | Source-available Python SDK and gateway that verifies an agent's outbound HTTP requests and MCP tool calls against a source of truth using zero-knowledge proofs, so a call only goes out if its claims check out. Allow-lists trusted endpoints and logs every outbound call for provenance. BSL 1.1, with a hosted backend for the proof and source-of-truth check. |
| Prismor Attestation Bundle | attestation, Ed25519, compliance-mapping | Ed25519-signed bundle of governance posture: agent inventory, host discovery (shadow AI sweep), audit-trail anchor, and framework-control coverage (OWASP LLM/Agentic, NIST AI RMF, EU AI Act). JCS-canonical, offline-verifiable. |
| aee-conformance | in-toto, attestation, recompute-verify | Conformance vector suite and reference verifier for the in-toto Adversarial Execution Evidence (AEE v0.7) predicate. Execute-and-attest model: consumer recomputes outcome from carried bytes rather than trusting producer verdicts. |
Projects and technologies that separate (isolate) credentials and tokens from the main agent runtime.
| Name | Keywords | Description |
|---|---|---|
| 🔥 nono secrets management | keyring, OS-secure-store, Landlock | nono's secrets management layer using OS-native secure stores (e.g., keyring) to isolate credentials from the agent runtime entirely. The credential injection proxy implements a phantom token pattern where the agent only sees a per-session token and real credentials are swapped in by a host-side proxy. |
| 🔥 iron-proxy | MITM-proxy, egress, secret-injection, DNS, SSRF | MITM egress proxy with built-in DNS server: default-deny at the network boundary (domain/CIDR allowlist, everything else gets a 403), boundary-level secret injection (workloads use proxy tokens worthless outside the proxy — real creds swapped in at egress), upstream IP deny list closing SSRF/DNS-rebinding gaps (IMDS blocked by default), per-request structured JSON audit trail, streaming-aware (WebSocket/SSE). Single binary, single YAML. |
| 🔥 agent-creds | Macaroons, Envoy, iptables, TLS-interception, Docker, credential-injection | Network-isolated Docker sandbox with iptables-enforced traffic routing through an Envoy TLS-intercepting proxy, where a vault service validates Macaroon tokens (scoped by host, method, path, and expiry) and injects real API credentials server-side. |
| 🔥 wardgate | gateway, credential-injection, SSH, IMAP, SMTP, containers, approval-workflow | Security gateway isolating credentials; agents authenticate to the gateway with their own key while real credentials are injected server-side — combined with "conclaves" (isolated containers with per-command policy, pipeline parsing, and tool/data/network isolation) |
| 🔥 Warden | gateway, SPIFFE, credential-brokering | Broker where agent presents JWT or TLS cert (SPIFFE SVID), Warden injects real credentials per-request — agent never holds secrets. Per-call role switching for mid-task least privilege, discovery protocol (agents introspect allowed roles/providers/skills). |
| 🔥 Riptides on-the-wire credential injection | kernel, SPIFFE, Vault, OpenBao, credential-injection | Kernel-space interception of outbound agent requests with on-the-wire injection of Vault/OpenBao-sourced credentials via SPIFFE workload identity, ensuring secrets never materialize in agent user space. |
| 🔥 kloak | eBPF, uprobes, TLS-interception, Kubernetes, secret-injection | Kubernetes eBPF secret injector that hooks TLS writes via uprobes (OpenSSL, BoringSSL, Go): applications only see hashed placeholder tokens, real secrets exist solely in eBPF maps and are swapped in-kernel before encryption. |
| clawshell | proxy, virtual-keys, DLP, Unix-permissions | Drop-in sidecar proxy for OpenClaw that maps virtual API keys to real provider credentials (stored in a Unix-permission-protected config), with regex-based DLP scanning that can block or redact PII in request/response bodies before they reach upstream LLM APIs. |
| onecli | proxy, secret-injection, per-agent-tokens | Rust gateway, agents use placeholder keys, gateway swaps real credentials at request time matched by host/path patterns. AES-256-GCM at rest, per-agent scoped access tokens. |
| sandbox-proxy | proxy, secret-injection, egress-filtering | Stdlib-only Go forward proxy injecting credentials on the wire into Docker sandbox outbound HTTPS. Workload never sees tokens; default-deny mode available (allow_all: false), HTTPS interception via generated CA, credential injection scoped to configured hosts only. |
| secretless-ai | hooks, secret-injection, keychain | Keeps credentials out of AI context windows, esp. for Claude Code it installs a PreToolUse hook that intercepts every file read, grep, glob, bash, write, and edit before execution. Supports multiple secret backends (local AES-256-GCM, OS keychain, 1Password). |
| enject | secret-isolation, CLI, subprocess-injection | Rust CLI (formerly enveil) that replaces .env plaintext values with en:// placeholder references while real values are stored in an Argon2id-derived AES-256-GCM encrypted local store. Decrypts, resolves references, injects real values into the subprocess environment, then zeroizes key material. Deliberately omits get/export commands to prevent AI-readable secret leakage. |
| airut masked secrets | proxy, masked-secrets, network-allowlist, AWS-SigV4 | mitmproxy transparently intercepts all HTTPS traffic, generates format-preserving surrogate tokens, injects them into the container's environment, and the proxy swaps surrogate → real value in outgoing request headers only for scoped hosts. |
| Tailscale Aperture | gateway, credential-injection, Tailscale, observability | Alpha LLM API gateway running on a tailnet, extracts the model name from each request body, routes to the correct provider and injects provider authentication headers server-side. |
| latchkey | credential-injection, curl, browser-login, agent-skills | TypeScript CLI that injects stored credentials into curl requests to known third-party APIs (Slack, GitHub, Discord, Linear, Google Workspace, AWS, Stripe, and ~25 more). Credentials are encrypted under ~/.latchkey using the OS keyring. |
| authsome | OAuth2, credential-store, token-refresh | Local credential layer for AI agents: log in once via OAuth2 or API key, authsome keeps tokens fresh (auto-refresh, expiry handling) across scripts, cron, CI, and parallel pipelines. Single encrypted store for all providers; agents call it at runtime instead of reading env vars. |
| authproxy | proxy, credential-injection, OAuth2, audit | Embeddable open-source iPaaS HTTP proxy: application sends requests without credentials, authproxy injects the appropriate auth (OAuth2 bearer, API key), auto-refreshes expired tokens, logs every request for auditability. Declarative YAML connector definitions, pre-built admin UI, connector marketplace. |
| LEASH | MCP, vault, action-execution, zero-exposure, connection-contracts | Proposed companion standard to MCP for secret handling. Vault executes operations on the agent's behalf using secrets and returns only results. Platform-bound credentials + binary attestation of the connector process. |
Other secret management tools of potential interest include: sops, fnox, dotenvx, varlock, and envio.
Specs, proposals, reference implementations, extensions and protocols to give agents credentials that represent their intrinsic code and workload identity, and capture provenance, intent, and integrity, to assist in AuthNZ with other systems, and represent the authority and intent of the human goals behind them.
Note
For good bird's-eye overviews, see Andrew Green's overview of agent auth solutions and Agents now have too many identities.
- AAuth (IETF draft, full implementation demo with Keycloak + Agentgateway; real world implementation of AAuth + RFC 9421 HTTP Message Signatures; PoC: UMA for Agents
- Verifiable Intent (blog post, site)
- AI Agent Auth and Authz (IETF) (composing WIMSE, OAuth 2.0, Transaction Tokens, and HTTP Message Signatures)
- Agent Native Authorization (IETF)
- CAAM (IETF) (bridges SPIFFE workload identity and IPSIE human identity with ReBAC, RATS attestation, and purpose-bound delegation)
- FAPI / RAR (RFC 9396), SD-JWT (RFC 9901), Transaction Tokens and agent extension (implementations: Tokenetes, kontxt, keycloak-tts), Identity and Authorization Chaining Across Domains, Txn-Token Chaining Profile, OAuth Actor Profile, Attenuating Agent Tokens, Verifiable Attenuated Delegation for AI Agent Chains, Human Delegation Provenance (HDP) (Ed25519-signed append-only hop chain binding human authorization to agent sessions), DAAP (runtime identity for dynamically-spawned agents), CB4A (credential broker architecture: PDP/CDP separation, SPIFFE identity, DPoP binding, proxy/mint/wrap delivery patterns), ID-JAG (Identity Assertion JWT Authorization Grant — agent provider signs assertion for cross-domain identity hop; see auth.md for an agent onboarding profile composing ID-JAG with discovery, account linking, client establishment, and delegated access in one click; analysis), CAEP and SSF, Deferred Token Response (async approval-gated token issuance — agent polls while human reviews), Transaction Authorization Challenge (agent presents to AS for human/authority approval, receives RAR-scoped token as evidence; agent untrusted to modify challenge), Condition-Bound Keys (hardware-rooted non-exfiltratable key that exists only while actor + platform + local policy conditions hold), JWT Authorization Grants in MCP, Token Exchange in MCP, AWS Bedrock AgentCore OBO token exchange (RFC 8693 / RFC 7523 OBO for agents, also Microsoft EntraID OBO sample)
- x401 — draft HTTP protocol for route-scoped verifiable-credential requirements, carrying verifier-authored OpenID4VP/DCQL requests that agents can invoke or relay and optionally exchange for short-lived OAuth tokens.
- Workload identity and attestation: WIMSE, WIMSE for AI Agents, DNSid (DNS-anchored durable agent identity), OpenID WISE (Security Event Tokens for workload identity state changes, building on SSF/CAEP), Waffles, Trustworthy Workload Identity, CoSAI Remote Attestation
- Bot/agent authentication to websites: WebBotAuth WG, architecture (HTTP Message Signatures for automated traffic), signatures directory, anonymous bot auth with rate limiting
- Agent communication transport governance: AGTP Composition; Kubernetes SIG Network's Dynamic Auth, which combines ServiceAccount or SPIFFE workload identity with MCP-aware CEL authorization compiled into Envoy RBAC conditions.
- Posture-based trust negotiation: ZTNP (Zero-Trust Negotiation Protocol — session-scoped trust negotiation where agents/tools prove security posture against publicly-identified frameworks like NIST AI RMF; issues short-lived channel-bound Permits; companion ZTIP adds multi-principal delegation and prompt-injection-resistant intent binding)
- Distributed policy engines (PEPs/PDPs): AuthZEN, Cedarling, casbin, Oso, Keycard
- Decentralized trust registries:
- Agent Name Service v2 (ANS) (specification, reference implementation) anchors agent identity to verified DNS-domain control, supports mTLS and DNSSEC/DANE, and can seal lifecycle events into a SCITT-aligned transparency log.
- Trust over IP (explainer)
- Verifiable Trust
- TRQP
- Anonymous Credentials (ARC)
- Agentic Resource Discovery (ARD) defines federated capability search over domain-published JSON-LD entries. ARD delegates signing and verification semantics to the declared trust framework; an IETF Internet-Draft maps its discovery and trust metadata onto AGTP.
- Directory (dir), agent records described using OASF
- DNS-AID (IETF draft-dnsaid)
- ZTDNAID (URI scheme for cryptographically verifiable Zero-Trust Digital DNA Identifiers; hash-based, trust-registry-resolvable, SCITT-aligned)
- DAWN
- Research and frameworks:
- Agent Access Model (AAM) — reference architecture combining short-lived task-scoped sender-constrained credentials, authorization of frozen request representations, independent harness and network mediation, and a monotonic Trust Ratchet that can only remove capabilities before protected data is released; also identifies authorization provenance through shared context and caches as the unresolved multiplayer-access problem.
- Inter-Agent Trust Models
- Identity Management for Agentic AI (OpenID Foundation)
- Delegated Authorization Constrained to Semantic Task-to-Scope Matching
- Authorization Propagation in Multi-Agent AI
- PIC Model (edge simulation)
- Nanda Unified Architecture, IAM for Agents, AIS-1
- Agent Identity Protocol (AIP) with (Go SDK)
- 🔥 AIP — Biscuit-based append-only delegation chains with Ed25519 identities and Datalog scope attenuation (IETF draft, paper).
- opena2a agent-identity-management
- Specification Compendium (naftiko)
- AGBAC with reference implementation
- Intent-Based Access Control for Agentic AI
- ZeroID
- Vega (Microsoft Research)
- Forums and working groups: DIF Trusted Agents WG, KYA-OS, DIF TAAWG Mailing List
- Also worth noting: Progressive Authentication, Capability Negotiation, EAM-SQL Safety Envelopes, Permission Protocol
Several good ideas are also explored in blog posts and articles, including CSA Agentic AI IAM Whitepaper, DCR for MCP, SPIFFE and OAuth, Verifiable Credentials for AI, Continuous Authorization, Delegated Authorization, Delegation patterns, Cedar delegation for OpenClaw subagents (policy-aware agent loop demo), Riptides, Encoding User Intent, ID-JAG, Qualified VDRs, Agents and Payments Identity, Ambient Mesh, Token-Based Access Control, Applicability of Standards, Chaining and Nesting for Lineage, and FGA for Agent Authorization.
Papers, frameworks, and documents discussing agent runtime security, threat models, and recommended mitigations.
- Threat models and top-10 style frameworks
- OWASP Top 10 Agentic
- Meta: Practical AI Agent Security
- AWS Agentic AI Security Matrix
- AARTS
- Attack and Defense Landscape of Agentic AI
- See also the Weather Report analysis
- Agents of Chaos
- APPA: Agentic Permissions Policy Algebra (formal IFC framework using context branching for taint confinement in tool-using agents)
- FAVA: Formal Authorization for Verified Agents
- CNCF Cloud-Native Agentic Standards (Kubernetes-focused Zero-Trust framework for agentic workloads)
- AARM: Autonomous Action Runtime Management (paper)
- CUSTODY — containment framework for autonomous agents, classifying by Level/Mandate/Reach and addressing capability accretion drift
- AGCP: Agentic Governance Control Plane
- Distributed Trust Framework (DTF)
- Zones of Distrust (ZoD)
- Execution Outcome Attestation (IETF)
- MCP-focused security documents:
- Security of AI Agent Communication Protocols
- Cryptographic integrity of tools, models, and data:
- Auditing AI Agent Delegation and Interactions is a cross-layer audit architecture composing OAuth, WIMSE, RATS, and SCITT into four record types (Interaction, Action, Delegation, Authorization Transition)
- Agent Audit Trail (AAT) defines a JSON-based hash-chained logging format with mandatory agent identity, action classification, and trust level fields — maps to EU AI Act, SOC 2, and PCI DSS requirements.
- Why sandboxing matters?
- The Agent Sandbox Taxonomy
- pleasedonotescape.com (data) — structured dataset of AI agent sandboxes with per-agent support matrices, threat-model vector mapping (accidents, exfiltration, hostile escape), and evidence-carrying claims for isolation, credential mediation, and network policy
- SANDBOXESCAPEBENCH finding that capable models can identify and exploit container escape vulnerabilities
Entries in this reference section (mostly Linux security primitives) are not specific to the agent runtime security problem, but might be interesting for some readers.
Containers and Linux namespaces: ExitBox, code-sandboxes, Kilntainers (MCP server routing agent tool calls to Docker/Podman, E2B, Modal, or WASM sandboxes), nanoclaw, yolobox, agentbox, construct-cli, and ctenv all rely on standard Linux container isolation. Scion runs agents in isolated Docker/Kubernetes containers with per-agent identities, credentials, and workspaces. try and usand use Linux namespaces via unshare to let commands run in a contained environment. nsjail is Google's lightweight process isolation tool combining Linux namespaces, cgroups, and seccomp-bpf. sandbox (Cloudflare) provides a seccomp library for syscall filtering. systemd's exec security settings and setpriv serve as convenient declarative frontends for composing namespaces, seccomp, and capabilities. Axocoatl (site) is a Rust multi-agent runtime with capabilities dropped. Running AI Agents in Devcontainers is a practical guide to using devcontainers as flexible, fully-custom agent sandboxes.
Also read: User namespaces are not a security boundary.
Bubblewrap: bubblewrap is an unprivileged sandboxing tool that backs several projects listed here. It can be applied directly to Claude Code or OpenCode. Associated tools include nixwrap, a Nix-declarative wrapper, sandbox-run a minimal CLI around it, Grauwolf's sandbox-run a per-project wrapper that isolates file writes, tmp, and tool state, and flar a multi-agent bubblewrap harness with isolated-network-namespace egress proxy.
Landlock: Landlock is a stackable LSM for unprivileged filesystem and network restriction. island is the go-to sandbox tool. landrun and rstrict are CLI tools for restricting process access. landdown is a shebang-based Landlock sandbox for shell scripts. Litterbox combines Landlock with Linux namespaces. Cursor uses Landlock. aide is a Landlock-first multi-agent launcher. Also read: Landlock: Idea to Implementation and Landlock integrations.
Sandboxed and virtualized runtimes: gVisor intercepts Linux syscalls to shrink the attack surface for containerized workloads without full hardware virtualization (see also MAGI: Multi-Agent gVisor Isolation for a practical walkthrough). Chimera takes a different approach: same-ISA dynamic binary translation intercepts every guest syscall in userspace without a VM, container, or kernel features (paper). Kata Containers provide lightweight virtual machines with a standard container interface. libkrun is a library for running lightweight KVM-backed VMs that serves as the hypervisor isolation layer for boxlite, brood-box, krunai, microsandbox, and several other agent sandboxes in this list. go-microvm is a Go framework for running OCI images as microVMs via libkrun. nerdbox is a containerd runtime shim that runs each container in a libkrun VM, rootless and cross-platform. styrolite is Edera's container runtime engine that runs containers inside VM guests via a type 1 paravirtualized hypervisor (see the Edera hypervisor paper). microvm.nix is a Nix Flake for declaratively building and running NixOS MicroVMs across hypervisors (cloud-hypervisor, Firecracker, QEMU, crosvm, etc.) Lima wraps QEMU, Apple Virtualization.framework, and krunkit as VM backends. vmexec is a zero-setup CLI for running commands in throwaway VMs built on rust-vmm crates. Deno Deploy Sandbox is a managed sandbox API that gives each execution a dedicated Firecracker microVM. Spindle is Tangled's open-source QEMU MicroVM runner that leverages Nix/NixOS. The OpenClaw MicroVM walkthrough demos MicroVM-based agent sandboxing using cloud-hypervisor.
WASM and browser-grade isolation: langchain-sandbox and Pyodide bring Python into WASM for sandboxed agent code execution; RLBox provides WASM-based library sandboxing for isolating untrusted components within a process; wassette applies WASM at fine-grained component boundaries. V8 Isolates offer a lightweight per-request isolation model as an alternative to containers or VMs (see also Cloudflare's Dynamic Worker Loader)
To expand further, consider reading:
- Survey of Real-World Process Sandboxing
- awesome-sandbox
- Ikangai Sandboxing Guide
- ORCA Evaluation Criteria Matrix (structured evaluation framework for isolation technologies)
- The State of MicroVM Isolation in 2026
- Leveraging Kernel Security for Containers
- Security Challenges in Container Cloud