Hazmat: Open-source containment for AI agents
Hazmat is an open-source tool that runs AI coding agents inside a separate account on your own machine. It wraps the harnesses people use: Claude Code, Codex, OpenCode, Cursor Agent, and several more, plus any script you write yourself.
An agent launched the ordinary way runs as you, which means it can read anything you can read. That includes SSH keys, cloud credentials, and the pile of configuration in your home directory that has accumulated over years. Hazmat gives the agent a home of its own and shares only the project directory you point it at. Your keys and credential folders sit outside what the session can reach.
Read the terms before the agent starts
Before anything launches, one command shows you the terms of the session. It lists the directory the agent can write to, the paths it only gets to read, whether it can reach the network or any services, and whether a backup runs first. Take the ten seconds and read it. That printout is the last moment you get a look at what the agent can touch, and everything after it happens while you are not watching.
On macOS the launch does four things in order: back up the project, build a sandbox policy for that one session, switch to the agent account, then start the harness. A firewall rule is already in force by then. Linux runs natively, and a backend using Apple’s container tooling sits behind an experimental flag.
A demo you can run yourself
You can test the boundary in about a minute. A demo script creates a throwaway project, switches networking off, and runs a single contained command that writes a file into that project and reaches for a private key in your real home directory. The write lands. The key comes back unreadable, and the comparison afterward lists one new file in the project and nothing else touched.
About 5.5 percent of the code is a formal specification written in TLA+, a language for describing how a system should behave so the description can be checked by machine. The project calls its design verified on that basis. What got checked is the containment model on paper, and the Go binary you install is a separate piece of work with its own bugs.
Hazmat is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!