Chock is a sandbox-first AI coding harness that runs coding agents inside the operating system's own sandbox on a throwaway copy of the project, under a policy file the agent can read but cannot edit.…
Yorick Peterse merged a new Inko feature that lets applications sandbox themselves with minimal effort, using Linux Landlock, macOS Seatbelt via sandbox_init, FreeBSD Capsicum, and OpenBSD pledge and …
DeepSeek Harness, an open-source agent framework released as a developer preview, ships a fail-closed filesystem sandbox using bubblewrap, Landlock, Seatbelt, or Windows ACLs, but its documentation st…
Bulwark, an OS-level read gate for AI coding agents, blocks file reads at the kernel level by inode before bytes reach the agent, preventing access to protected files like .env or .ssh. It uses fanoti…