Hazmat Open Source AI Agent Containment Solutions

Post Views: 8

Hazmat is an open-source solution designed to operate AI coding agents within an isolated account on a user’s local system.

Hazmat: Open-source containment for AI agents

Hazmat is an open-source solution designed to operate AI coding agents within an isolated account on a user’s local system. It integrates with existing tools such as Claude Code, Codex, OpenCode, Cursor Agent, and other similar harnesses, alongside custom scripts developed by users. When an agent is executed normally, it operates under the user’s permissions, granting access to sensitive data like SSH keys, cloud credentials, and configuration files stored in the home directory. Hazmat isolates the agent by assigning it a dedicated environment, restricting its access to only the project directory specified by the user. Sensitive files and credential storage locations remain outside the agent’s reach. Users must review the session terms before initiation.

Key Features

A single command displays the parameters of the session, including the directories the agent can write to, read-only paths, network access capabilities, and whether a backup process runs first. This step provides the final opportunity to verify the agent’s permissions before execution, as subsequent actions occur without user oversight.

Technical Implementation

On macOS, the launch process performs four steps sequentially: backing up the project, generating a sandbox policy for the session, switching to the agent account, and initializing the harness. A firewall rule is active by this point. On Linux, the tool operates natively, while an experimental backend leveraging Apple’s containerization technology supports macOS functionality.

Test Scenario

A test scenario demonstrates the tool’s effectiveness. A demo script creates a temporary project, disables network access, and executes a command that writes a file to the project directory while attempting to access a private key in the user’s home directory. The write operation succeeds, but the private key remains inaccessible, and post-execution analysis reveals only the newly created file as modified.

Codebase and Validation

Approximately 5.5% of the codebase consists of a formal specification written in TLA+, a language used to define system behavior for machine verification. The project claims its design is validated through this specification, though the Go binary distributed for installation is a separate component with its own potential vulnerabilities.