AI coding agents install packages, run commands, use the network and act with the developer’s credentials. To work faster, many engineers also turn on auto-approval, so the agent’s actions run without review. A mistake, or a malicious instruction hidden in a repository or a web page, then runs with access to the developer’s files, keys and accounts.
Brig keeps the agent inside a VM instead. The agent runs on a kernel of its own, isolated by the processor’s hardware virtualization support (Hypervisor.framework on macOS, KVM on Linux). It sees only the project directory it is given and the credentials its profile names. It does not see the rest of the disk, the keychain or the SSH agent. A network policy, enforced on the host outside the VM, can limit which hosts the agent reaches. When the work is done, the developer deletes the sandbox.
‘I lead the development of the urunc CNCF (Cloud Native Compute Foundation) Sandbox project, a container runtime for unikernels and microVMs. The virtual machine technologies I’ve been working on since 2007 are now more relevant as ever, due to the rise of AI agents and agentic workloads, which require the security and trust boundary to move lower without paying a significant performance tax,’ said Anastassios Nanos, co-founder and chief scientist of NOFire AI and a HiPEAC member.