{"slug": "nobody-talks-about-where-the-agent-actually-runs", "title": "Nobody Talks About Where the Agent Actually Runs", "summary": "Trail of Bits released Coop, an open-source Rust CLI that runs AI coding agents like Claude Code and Codex inside disposable Firecracker and Lima virtual machines, isolating them from the host system while retaining full tool access. Separately, a developer reverse-engineered Claude Code's existing execution environment, finding Firecracker microVMs, a custom Rust init process as PID 1, and model inference routed over SSE to an egress gateway, with cold boot to harness taking roughly 6.4 seconds. The analysis contrasts Anthropic's embedded-operator architecture with Instinct's external sandbox approach built on E2B.", "body_md": "AI coding agents have more system access than most intern hires — shell, file system, network, package managers — and the question of where they actually execute, and what they can touch, is only now getting serious attention.\n\n## 1. Trail of Bits Built a Jailhouse for Claude Code, Then Open-Sourced the Blueprints\n\nTrail of Bits — the security research firm that has spent decades finding ways into software systems — just released [Coop](https://github.com/trailofbits/coop), an open-source Rust CLI that runs Claude Code and Codex inside disposable virtual machines. Firecracker on Linux, Lima on macOS. Full tool access: Docker, git, compilers, package managers. Zero exposure to the host system. When you're done, the VM evaporates.\n\nThe product decision here is telling. Trail of Bits didn't build Coop because agents are useless without system access — they built it because agents with system access and no isolation are a liability. The question they're answering isn't \"can Claude Code write good code?\" It's \"what happens when it writes bad code, or gets confused, or follows a malicious instruction embedded in a dependency?\" The answer, without isolation, is: whatever the agent has access to, you now have a problem.\n\nThat framing — agents as powerful but inherently untrusted executors — is a security-first perspective that hasn't fully landed in the mainstream conversation yet. Most discussion around coding agents is about output quality. Trail of Bits is thinking about blast radius.\n\n**Why it matters:**\n\n**For ICs:** If you're running coding agents locally without sandboxing, you're one bad prompt away from a bad day. Coop takes about ten minutes to set up.\n\n**For leaders:** \"We gave everyone Claude Code access\" is not a complete security posture. The question of where agents run needs to be in the answer.\n\n**For founders:** Security-conscious enterprises won't adopt agentic tooling without answers to the containment question. Whoever solves this for the enterprise market has a real wedge.\n\n## 2. Someone Finally Looked Inside the Box Claude Code Actually Runs In\n\nWhile Trail of Bits is building their own containment layer, [one developer pulled apart the existing infrastructure](https://rohanadwankar.github.io/posts/platforms.html) to understand what's already underneath Claude Code. The answer: Firecracker microVMs, a stripped-down kernel, and a custom Rust init process running as PID 1 — with a vsock connection back to the host control plane and model inference routing through SSE over HTTPS/2 to an egress gateway. Cold boot to harness process: roughly 6.4 seconds.\n\nThe breakdown also covers Instinct, a competing agentic platform that takes the opposite architectural approach. Where Anthropic embeds the operator logic inside the guest VM, Instinct outsources the sandbox entirely to E2B and keeps the agent brain off-box. The sandbox becomes a stateless execution surface — all memory lives as git-versioned Markdown in S3, committed by the agent itself.\n\nThese aren't just implementation details. The two models represent a fundamental architectural fork: embedded operator versus external operator. The embedded approach is tighter and faster but couples agent behavior to infrastructure. The external approach is more portable and auditable — every action is in the commit log — but adds latency and operational complexity. Which architecture wins matters enormously for how agents scale, how they're audited, and what happens when something goes wrong.\n\n**Why it matters:**\n\n**For ICs:** Understanding the execution model helps you reason about what the agent can and can't do — and where failures will surface.\n\n**For leaders:** When evaluating agentic platforms, the architecture under the hood determines your audit, compliance, and incident response story.\n\n**For founders:** The embedded vs. external operator fork is an open design question with no obvious winner yet, which means there's room to stake a position.\n\nThe git-versioned agent memory approach is worth watching — it's the closest thing to a legible audit trail anyone has built for autonomous agent behavior.\n\n## 3. Isle Is Selling Managed Desktops for Computer-Use Agents. The Customers Are Real.\n\nThe previous two examples deal with containing agents in shell and code environments. [Isle](https://www.tryisle.com) is going one layer up: managed desktop environments for agents that need to operate graphical applications. Pre-configured, pre-installed, ready in seconds. The current supported apps — KiCad for electronics design, FreeCAD for 3D engineering — are niche choices, but deliberate ones.\n\nIsle is betting that the next wave of computer-use agents won't be running in terminals. They'll be navigating CAD tools, ERP systems, design software — any domain where the workflow still lives inside a GUI that no one has bothered to API-ify. The platform handles setup, monitoring, and checkpoint/restore so agents can pause and resume without losing state. That last feature is underrated: for long-running agent tasks that touch expensive-to-reconstruct application state, checkpoint/restore is the difference between recoverable and catastrophic failure.\n\nThe pricing is accessible enough to be real — $29/month for a developer tier with 100 environment-hours — and the problem they're solving is genuinely distinct from what anyone else is offering. The question is whether the use cases scale beyond a narrow band of engineering workflows. KiCad and FreeCAD are niche. The category above them is not.\n\n**Why it matters:**\n\n**For ICs:** If you're building computer-use agents that need GUI access, managing desktop environments is your first operational headache. Isle removes it.\n\n**For leaders:** Any workflow your team runs in a desktop application is now a potential target for agent automation. The infrastructure to support it is starting to exist.\n\n**For founders:** The managed execution environment is becoming its own product category, not a feature. That's a land-grab moment.\n\n## The Verdict: Real or Hype?\n\n**AI agent sandboxing → Real.** Agents with shell access and no isolation aren't safe; the tooling to fix this is open-source, mature enough to ship, and coming from a credible security source.\n\n**Managed execution environments for computer-use agents → Real but early.** The problem is genuine, the category is real, and the first movers are shipping — but the use case breadth is still narrow.\n\n**Architectural transparency for agentic platforms → Real.** The infrastructure under your coding agent is now detailed enough to reverse-engineer. That's accountability pressure, not just curiosity.", "url": "https://wpnews.pro/news/nobody-talks-about-where-the-agent-actually-runs", "canonical_source": "https://fromtheterminal.substack.com/p/nobody-talks-about-where-the-agent", "published_at": "2026-09-08 20:19:50+00:00", "updated_at": "2026-09-20 19:53:44.079598+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-infrastructure", "developer-tools", "ai-safety"], "entities": ["Trail of Bits", "Coop", "Claude Code", "Codex", "Anthropic", "Instinct", "E2B", "Firecracker"], "alternates": {"html": "https://wpnews.pro/news/nobody-talks-about-where-the-agent-actually-runs", "markdown": "https://wpnews.pro/news/nobody-talks-about-where-the-agent-actually-runs.md", "text": "https://wpnews.pro/news/nobody-talks-about-where-the-agent-actually-runs.txt", "jsonld": "https://wpnews.pro/news/nobody-talks-about-where-the-agent-actually-runs.jsonld"}}