Nobody reads the fortieth prompt #
An agent in your terminal can do anything you can. It can delete files outside the project, read your SSH keys, or follow instructions someone planted in a dependency's README. Approval prompts are meant to catch that, but by the fortieth you're clicking yes without reading. And they only ever see the command the agent typed, not what the build script went on to do.
So Airlock turns the prompts off and moves the agent somewhere the only thing of yours it can touch is a copy of your project. Your real folder is never shared with it, and it can't reach anything else on your Mac.
Nothing reaches your project until you say so #
When the agent's done, you get every file it changed as a diff. Tick the ones you want and they're applied to your project. Change your mind later and undo them. Build scripts, git hooks, CI config and the agent's own settings are flagged, because they run on your Mac later, and that's how an agent's code would get out.
See what actually ran #
Airlock watches from inside the virtual machine's operating system, so it sees every process, not just the commands the agent typed. If the agent writes a script that calls curl, you see the curl. Files it touched and servers it talked to are in the same timeline, as it happens. Anything that isn't a code host, package registry or the like is flagged, and you can lock a session to a list of hosts you choose.
You won't notice the virtual machine #
Type airlock run claude in a project folder and Claude Code opens in your terminal as normal, with your CLAUDE.md, skills and memory. airlock run codex does the same for Codex. It starts in seconds, the languages your project needs install themselves, and dev servers open in your Mac's browser as normal. It can't see your local network, so your router and NAS are out of reach.
Xcode, without a second Xcode #
Xcode projects get a macOS virtual machine that borrows the Xcode you already have, so there's no second copy to download and keep updated. React Native apps with an Xcode project in their ios folder get one too. Apple allows two macOS virtual machines at a time, so that's the limit.
Already using Docker Sandboxes? #
Docker Sandboxes also puts agents in a virtual machine, and can give them a clone of your project instead of the real thing. What it doesn't have is a per-file review before anything reaches your project, a record of what actually ran, or macOS sessions with your Xcode.
What it doesn't stop #
Airlock contains the agent. It doesn't make it trustworthy. Sessions can reach public hosts unless you lock them down, so anything in the copy of your project could be sent somewhere. Model requests go to Anthropic or OpenAI as usual. If the agent can reach a service, what it does there is real, and it happens before you've reviewed anything. And code you apply is still code: read it as you'd read a colleague's.
What you need #
A Mac with Apple silicon and macOS 26 or later. Claude Code with a Claude subscription, or Codex with a ChatGPT account.