Hazmat: open-source OS-level containment for Claude Code, Codex, OpenCode, and Cursor Agent

Tools official + media 2 src. ~1 min

Released 17 Aug 2026 by Denis Redozubov (dredozubov). Go CLI that runs Claude Code, Codex, OpenCode, Cursor Agent, or any custom agent harness in a separate OS user account with a macOS sandbox-exec profile, pf firewall, and DNS blocklist; only the chosen project directory is shared, so SSH keys and cloud credentials stay out of reach. Pre-launch summary shows writable/readable paths, network access, and backup status; takes a per-session snapshot for rollback. Ships with a ~5.5% TLA+ formal specification of the containment model and a demo that intentionally tries to read a private key to verify isolation. Linux runs natively; an Apple-container backend is experimental.

Why it matters

Solves the central operational risk of agentic coding — a misbehaving or prompt-injected agent running with full user privileges. The TLA+ spec is rare in this category: most agent sandboxes ship as opaque binaries.

Importance: 4/5

open-weights / GA marker, security topic marker

open-source sandbox security coding-agent macos claude-code codex opencode cursor

Sources

official dredozubov/hazmat on GitHub

media Help Net Security — Hazmat open-source AI coding-agent containment