sandvault

Sandbox and separate user instead of VM but sandvault is good for this and does auto install (full disclosure: have made some PRs to it). https://github.com/webcoyote/sandvault

I added browser automation capabilities to sandvault [0], a MacOS sandbox, to allow AI agents to control Chrome browser from within the sandbox, which makes coding & testing websites from within the sandbox much easier. I'm using sandvault+Claude to rebuild my personal blog, Code of Honor [1], because I got tired of WordPress. The site includes search functionality, and articles are automatically syndicated to Mastadon, BlueSky, and Twitter. I wrote a Claude skill to automate testing of iOS apps [2], and it found issues in one of my released apps [3]. [0]: https://github.com/webcoyote/sandvault [1]: https://www.codeofhonor.com [2]: https://github.com/webcoyote/AppTestCircuit [3]: https://www.codeofhonor.com/blog/finding-bugs-with-an-automa...

Sandvault [0] (whose author is around here somewhere), is another approach that combines sandbox-exe with the grand daddy of system sandboxes, the Unix user system. Basically, give an agent its own unprivileged user account (interacting with it via sudo, SSH, and shared directories), then add sandbox-exe on top for finer-grained control of access to system resources. 0. https://github.com/webcoyote/sandvault

OK, let’s survey how everybody is sandboxing their AI coding agents in early 2026. What I’ve seen suggests the most common answers are (a) “containers” and (b) “YOLO!” (maybe adding, “Please play nice, agent.”). One approach that I’m about to try is Sandvault [0] (macOS only), which uses the good old Unix user system together with some added precautions. Basically, give an agent its own unprivileged user account and interact with it via sudo, SSH, and shared directories. 0. https://github.com/webcoyote/sandvault

> user permissions/groups never come into the sandboxing discussions Sometimes *nix user accounts for AI agent sandboxing does come up in discussions. At [0], HN user netcoyote linked to his sandvault tool [1], which "sandboxes AI agents in a MacOS limited user account". Actually seems like a great idea IMO, to be lightweight, generic, and robust-enough. [0] https://news.ycombinator.com/item?id=46760777 [1] https://github.com/webcoyote/sandvault

- https://github.com/webcoyote/sandvault: sandboxes AI agents in a MacOS limited user account, and also uses sandbox-exec to limit access, though fence has more strict limitations - https://github.com/webcoyote/clodpod: sandboxes AI agents in a MacOS virtual machine Note: I’m the author of both of these Apache open-source projects

This is the solution I chose for sandvault [0], which works well on my Mac since agents can run OSX-specific tools. It just got added to Homebrew: brew install sandvault Or clodpod [1] for a VM-based solution 0: https://github.com/webcoyote/sandvault 1: https://github.com/webcoyote/clodpod

Here are my open-source (MIT) solutions for Mac development: SandVault [0]: Run AI agents isolated in a sandboxed macOS user account ClodPod [1]: Run AI agents isolated inside an OSX virtual machine 0: https://github.com/webcoyote/sandvault 1: https://github.com/webcoyote/clodpod

I use a Mac, and wanted to be able to run MacOS programs like Xcode and iOS simulator, so I wrote a couple of different sandbox projects: - SandVault (https://github.com/webcoyote/sandvault) runs the AI agent in a low-privilege account - ClodPod (https://github.com/webcoyote/clodpod) runs the AI agent inside a MacOS VM In both cases I map my code directories using shares/mounts. I find that I use the low-privilege account solution more because it's easier to setup and doesn't require the overhead of a full VM

Here are a couple of (open-source Apache license) projects I wrote to sandbox on Mac, which I use to run my agents, while still being able to build/run macOS apps: Limited user account: https://github.com/webcoyote/sandvault Virtual machine: https://github.com/webcoyote/clodpod

I'm playing around with sandboxing techniques on Mac so I can isolate AI tools and prevent them from interacting with files they shouldn't have access to -- like all my dotfiles, AWS credentials, and such. I've created two open-source solutions, one which uses a VM (https://github.com/webcoyote/clodpod) and another which creates a limited-user account with access to a shared directory (https://github.com/webcoyote/sandvault). Along the way I rolled my own git-multi-hook solution (https://github.com/webcoyote/git-multi-hook) to use git hooks for shellcheck-ing, ending files with blank lines, and avoid committing things that shouldn't be in source control.