Hazmat: Open-source containment for AI agents
Open-source tool Hazmat runs AI coding agents like Claude Code and Codex in a dedicated account, restricting access to credentials and files.
Hazmat is a free open-source containment tool that launches AI coding agents, including Claude Code, Codex, OpenCode and Cursor Agent, under a separate local account, sharing only a chosen project directory and enforcing per-session sandbox policies, network rules, and optional backups. On macOS it backs up the project, builds a session-specific sandbox policy, and starts the harness behind a firewall rule; Linux runs natively and an Apple-container backend is experimental. About 5.5% of the code is a TLA+ formal specification of its containment model.
- Shields SSH keys, cloud credentials and home-directory configuration from AI agents by default
- Pre-launch printout shows allowed write paths, read paths, network access and backup behavior
- Demo verifies an agent can write to the project but cannot read a private key in the home directory
- TLA+ specification covers the containment model, not the installed Go binary
- Vendors
- Hazmat
From the original article
2 min read at helpnetsecurity.com
Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself. An agent launched the ordinary way runs as you, which means it can read anything you can read.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.