Hazmat: Open-source containment for AI agents
Open-source tool Hazmat runs AI coding agents like Claude Code and Codex in a dedicated account, restricting access to credentials and files.
Hazmat is a free open-source containment tool that launches AI coding agents, including Claude Code, Codex, OpenCode and Cursor Agent, under a separate local account, sharing only a chosen project directory and enforcing per-session sandbox policies, network rules, and optional backups. On macOS it backs up the project, builds a session-specific sandbox policy, and starts the harness behind a firewall rule; Linux runs natively and an Apple-container backend is experimental. About 5.5% of the code is a TLA+ formal specification of its containment model.
- Shields SSH keys, cloud credentials and home-directory configuration from AI agents by default
- Pre-launch printout shows allowed write paths, read paths, network access and backup behavior
- Demo verifies an agent can write to the project but cannot read a private key in the home directory
- TLA+ specification covers the containment model, not the installed Go binary
Full article433 words · extracted from helpnetsecurity.com · click to collapse
Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself.
An agent launched the ordinary way runs as you, which means it can read anything you can read. That includes SSH keys, cloud credentials, and the pile of configuration in your home directory that has accumulated over years. Hazmat gives the agent a home of its own and shares only the project directory you point it at. Your keys and credential folders sit outside what the session can reach.
Read the terms before the agent starts
Before anything launches, one command shows you the terms of the session. It lists the directory the agent can write to, the paths it only gets to read, whether it can reach the network or any services, and whether a backup runs first. Take the ten seconds and read it. That printout is the last moment you get a look at what the agent can touch, and everything after it happens while you are not watching.
On macOS the launch does four things in order: back up the project, build a sandbox policy for that one session, switch to the agent account, then start the harness. A firewall rule is already in force by then. Linux runs natively, and a backend using Apple’s container tooling sits behind an experimental flag.
A demo you can run yourself
You can test the boundary in about a minute. A demo script creates a throwaway project, switches networking off, and runs a single contained command that writes a file into that project and reaches for a private key in your real home directory. The write lands. The key comes back unreadable, and the comparison afterward lists one new file in the project and nothing else touched.
About 5.5 percent of the code is a formal specification written in TLA+, a language for describing how a system should behave so the description can be checked by machine. The project calls its design verified on that basis. What got checked is the containment model on paper, and the Go binary you install is a separate piece of work with its own bugs.
Hazmat is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/17/hazmat-open-source-ai-coding-agent-containment/