Sandboxes

The job

Agents run code, open browsers and hold credentials, so people look for somewhere to run them that limits what they touch. A sandbox here means a runtime, a service or a platform that gives an agent its own workspace, and often rules for files and network use.

How they differ

Some are for operators of Kubernetes clusters. Substrate places agents in gVisor or microVM sandboxes and snapshots idle ones. Ax is a command-line tool that runs declared agent tasks on top of substrate. SPACE runs code in Firecracker microVMs behind an HTTP API. These suit platform teams that already run clusters.

OpenShell is a sandbox runtime with a command-line tool, a gateway and SDKs. The project says it confines what an agent can reach to a policy you write. It may suit teams running agents on Linux with Docker or Podman.

Computer and cloudflare-os sit on Cloudflare Workers. Computer gives an agent a virtual filesystem and a choice of execution backends. Cloudflare-os is a template for a company agent workspace.

Cua offers disposable macOS, Linux and Windows environments for agents that operate whole desktops.

Another kind is a harness that includes sandboxing, by its project's account. Trueforge, qm, omnigent and openhuman run the agent loop and add approvals, memory or policies. Omnigent sits over several coding agents at once.

Rakazo gives each persistent agent its own computer with a browser and terminal, and openmuse is a template for a personal assistant app.

Licences

On 10 November 2026, GitHub detected Apache-2.0 or MIT on most of the tools here. Openhuman carried GPL-3.0. A licence can change, and each tool's own page gives the latest reading with its date.

What to check first

Isolation claims are the projects' own, and substrate asks readers to study its security guide and threat model. Omnigent says its Windows backend does not isolate files or the network, and it picks up model credentials already present.

Default access is a second worry. Qm's README says its default posture lets the agent act with each person's credentials, with content screening off, and that its Dangerous posture takes the approval steps away. Trueforge warns that local mode has no login. Openmuse uses one shared access key, and its terminal needs Docker access.

Several projects have early status. Ax expects breaking changes. Cloudflare-os describes rough edges, and computer calls its container backend experimental. Openmuse is labelled alpha.

Install and data flow need a look. Cua, omnigent and openhuman install through a fetched script run by a shell. Rakazo pulls edge images built from the main branch. OpenShell and openmuse collect telemetry. Cua has a paid tier under a separately named licence, and rakazo charges optional data services with a markup.