Hazmat: Sandboxing AI Coding Agents with Least Privilege

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Here is the uncomfortable truth about every AI coding agent you run today. When you launch Claude Code, Codex, OpenCode, or Cursor Agent, the process executes with your user account — the same account that holds your SSH keys, your cloud credentials, and read access to your entire home directory. The agent is not a contained worker; it is you with a model attached. One prompt-injected file, one mis-scoped refactor, or one hallucinated destructive command, and the agent's ambient read access quietly becomes an attacker's read access.

Enter Hazmat, an open-source tool that surfaced on GitHub around August 17, 2026 and is free to use. Its premise is simple: stop treating the agent as your doppelganger and treat it as a guest worker with least privilege. Hazmat wraps Claude Code, Codex, OpenCode, and Cursor Agent, and runs the agent inside a separate OS account that shares nothing but the project directory you explicitly declare.

Why running as you is the real vulnerability

The most dangerous property of agentic coding is not the model's reasoning — it is the ambient authority the agent inherits. A typical developer session gives the agent access to:

• SSH keys in ~/.ssh, which can reach production servers and the git remotes that hold the crown-jewel codebase.
• Cloud credentials in ~/.aws, ~/.config/gcloud, and similar locations, which can mint permissions far beyond the repository.
• Home-directory configuration, including dotfiles, saved tokens, password-manager caches, and private notes.

Prompt injections from third-party code, README files, or tool outputs routinely convert that ambient authority into real exfiltration. The classic mitigations — telling the model "never read credentials," or relying on post-hoc audit logs — fail because they depend on the reasoning engine rather than the operating system. Sandboxing moves the decision out of the model and into the kernel.

What Hazmat actually does

Hazmat implements a containment model with a few hard guarantees:

• The agent runs in its own dedicated OS account, not yours.
• Only the declared project directory is shared with that account.
• The session is scoped per launch: a fresh policy, a fresh firewall rule, a fresh set of permissions.
• Everything else — home directory, SSH keys, network endpoints — is excluded unless you explicitly opt in.

Before a session starts, Hazmat shows you the session terms: the writable directory, the read paths, the allowed network endpoints, and whether a backup will be taken. You see the boundary before the agent sees your code.

The macOS flow: four steps to a contained session

On macOS the flow is concrete and worth walking through, because it shows how much work the tool absorbs on your behalf:

1. Back up the project. The declared project directory is snapshotted before the agent writes anything, so a destructive refactor is recoverable in seconds.
2. Build a per-session sandbox policy. Hazmat assembles a policy encoding the writable paths, read paths, network rules, and session duration.
3. Switch to the agent account. The harness moves execution into the dedicated OS account, so file access is governed by OS permissions rather than model instructions.
4. Start the harness with a firewall rule. Network access is filtered at the OS level — the agent reaches only the endpoints you declared, and outbound data stays inside the boundary.

Each step is a deliberate, observable action, which is exactly what least-privilege discipline is supposed to look like.

5.5% of the codebase is formal specification

The most telling detail about Hazmat's ambition is that roughly 5.5% of its codebase is written in TLA+, the formal specification language used to model concurrent and distributed systems. That fraction is unusual — almost unheard of for a developer tool. It signals that the authors did not just write the sandbox; they wrote a formal model of the sandbox and verified its invariants. For a tool whose entire job is to enforce a security boundary, specification is not ceremony, it is the deliverable. When you sandbox an agent, the code you are trusting is not the model's next token — it is the boundary logic, and that logic has been checked against a formal model.

The containment ladder: prompt, container, VM, or OS account

To see why an OS account is the right rung, compare the containment layers available to a coding agent:

Prompt-level guards cost nothing and are worth doing, but they are advisory. Containers raise the bar and are a good middle ground for CI and server-side agents, yet a bind mount of the home directory — a very common convenience — silently recreates the original problem. VMs give the strongest kernel isolation but are heavyweight for an interactive editing loop. A dedicated OS account, the approach Hazmat takes, sits at the sweet spot: the kernel itself denies access to anything outside the declared project, with latency low enough for interactive use.

What the test demo actually proves

The Hazmat demo is deliberately minimal. An agent writes a file into the project directory, then attempts to read a private key from ~/.ssh. The write lands. The private key is unreadable. The demo proves that the agent's capabilities are governed by the sandbox boundary, not by the model's willingness to follow instructions. If the agent is ever tricked into trying to read the key, the OS answers with a permission denied instead of a file stream. That separation — intent lives in the model, authority lives in the kernel — is the entire point.

ROI: time saved versus breach risk

Containment costs a little time and buys a lot of tail risk. A pragmatic reading of the numbers:

Sandboxing does not eliminate the agent's productivity upside; it trades roughly two minutes of setup per session for a decisive reduction in the probability that one bad session becomes a six-figure incident. For an individual developer, the math is about protecting your personal keys. For an organization, it is about turning the agent from an unmonitored power user into an audited, least-privileged identity.

Frequently Asked Questions

Why not just use Docker?

A container still shares the host kernel and usually mounts directories for convenience, so an accidental bind mount of the home directory silently recreates the original exposure. An OS account changes the identity of the process — the kernel refuses access based on the account, so even a containerized agent cannot read what the account cannot read. The two can be combined for defense in depth.

Does Hazmat work on Linux and Windows?

The reference implementation targets macOS, where account switching and firewall mechanics are straightforward. The same containment model applies on any OS that supports separate user accounts, so the approach is portable even where the scripted flow is not.

What happens to my MCP servers and network tools inside the sandbox?

Network access is governed by the firewall rule you accept in the session terms. You declare the endpoints the agent may reach; everything else is blocked. MCP servers can run inside the boundary or be accessed over the declared read paths.

Is 5.5% TLA+ a sign the project is over-engineered?

It is the opposite. TLA+ is used precisely on the part that must never fail — the security boundary. Formally modeling the sandbox invariants is how the authors prove the boundary holds, which is more trustworthy than shipping another layer of unverified glue code.

How long does the backup step take on a large repository?

The backup is scoped to the declared project directory and runs before the session. On typical repositories it takes seconds to about a minute; large monorepos are the worst case, and you can exclude heavy directories in the session policy.

Closing thoughts

AI coding agents are only as safe as the authority they inherit. Hazmat's contribution is to make that authority explicit, bounded, and enforced by the operating system instead of by a model's good behavior. As agent usage scales inside organizations, the teams that treat agents as least-privileged identities — not as supercharged versions of themselves — are the ones that will keep the productivity gains and leave the credential theft behind. For more context on how these tools fit the broader agent-security picture, browse the latest AI news roundups and the workflows library, then run the demo yourself and decide where your boundary belongs.