Secure infrastructure for AI agents.
Every AI agent gets its own sealed machine. Save it, copy it, and rewind it in about a second when the agent gets it wrong.
11,000
Built for teams whose agents touch what matters
- Banks & fintech
- Hospitals & pharma
- Government & defence
- Law firms
- SOC & incident response
- AI startups
- SaaS & dev teams
- Telecom
- Manufacturing & OT
- Energy & utilities
- Universities & research
- Insurance
kosa8 agent run -w ~/code/api claude kosa8: kit claude (node:22-alpine) kosa8: workspace ~/code/api -> /work (nothing else on the host is visible) kosa8: network closed except through the egress broker kosa8: brokering ANTHROPIC_API_KEY -> api.anthropic.com (the sandbox holds a placeholder, never the key) kosa8: sandbox claude-44059 ready in 653ms kosa8: running kit setup, then: claude
Eight problems, eight answers, sixty seconds. Sound on.
Who it's for
Give your agents everything. Risk nothing.
Let agents work unattended, without handing them the keys.
Claude Code and Codex run with your shell, your SSH keys and your cloud credentials. One poisoned package or one injected instruction reaches all of it.
- Each agent gets its own machine that sees one folder: the repo.
- API keys stay on your computer; the sandbox holds a placeholder.
- The network is closed except the hosts the agent needs.
- A bad run is undone with one rewind, processes and all.
End goal
Ship with agents at full speed. Risk nothing on the host.
- 0 real keys inside the sandbox
- 1 folder the agent can see
- ~1 s back to before it broke
Give every task its own computer — and branch it.
Every user's task needs an isolated machine. Containers share one kernel; full VMs are slow to start and cannot be copied mid-run.
- A real VM per task, ready in a fraction of a second.
- Fork a running machine into eight live copies; keep the one that passes.
- Third-party MCP servers each in their own sandbox, behind one policy.
- A Docker-compatible API, so your tooling already speaks to it.
End goal
One sealed machine per task, at the speed of a container.
- 178 ms to a running container
- 8 live copies from one command
- 1 policy for every tool server
Detonate samples and train analysts on machines that reset in seconds.
Malware needs a disposable, faithful machine and a network it cannot really reach. Rebuilding a training range for the next class takes hours.
- Samples run in a sealed VM whose only internet is simulated and recorded.
- Every detonation writes a signed report you can diff and verify offline.
- A range is prepared once; each trainee gets a live clone of it.
- One trainee's machine resets to the scenario without touching the rest.
End goal
Real malware, real attacks, nothing that escapes.
- 0 packets reach the real internet
- 1 signed report per detonation
- 1 clone per trainee, reset on demand
Put AI in production and still pass the audit.
The auditor asks what the AI did, who approved it and where the data went. Most agent tools cannot answer any of the three.
- Every action hash-chained and marked human or agent.
- Risky actions wait for one or two named approvers, signed.
- A signed org policy every machine enforces; CUI labels that only rise.
- FIPS 140-3 builds, offline licences, and no network at all if required.
End goal
Evidence a third party can check, without trusting you.
- Every action hash-chained, human or agent
- 2-person rule for what matters
- 0 bytes out when air-gapped
Let the agent run overnight. Sleep anyway.
You want agents doing real work while you're away, but one bad command can cost your laptop, your keys or your weekend.
- One line installs it; it runs on the Mac you already have.
- A checkpoint before the risky part; a rewind if it goes wrong.
- Local models with an OpenAI- and Anthropic-compatible API, no bill.
- Free for 14 days, no account and no card.
End goal
An agent that works the night shift, on a leash you set.
- 1 line to install
- $0 for local models
- 14 days free, no card
Play
Build boldly. We've got the wall.
Your agents move fast while the sandbox catches every threat. Join in — tap one for bonus points.
A game, not a benchmark — but the rules are kosa8's: a closed network, keys kept outside, every call on the record.
Built to be checked
Ship AI agents with complete confidence.
- Signed in public every release; the installer refuses one that does not verify
- Its own kernel a real VM, not a shared container
- Network enforced outside on the host, out of the sandbox's reach
- Speaks Docker the docker CLI and Compose work unchanged
- Evidence, not logs a hash-chained record a third party verifies
- Runs where you are Mac · Linux · Windows 11 · your cloud · air-gapped
Pricing
Solo
$29/month
One person, one assistant running.
4 at once · 64 GB sandboxes
Pro recommended
$89/month
One person driving a fleet of assistants.
16 at once · 128 GB sandboxes
Team
$169/person /month
A team with someone accountable for security. From 3 people.
48 shared · 256 GB sandboxes
Scale
$199/person /month
Large fleets that need capacity held for them. From 5 people.
160 shared · 500 GB sandboxes
Before you decide
The questions people ask first.
Do I need a card or an account to try it?
No. One line installs it, and every feature works for 14 days. Nothing to sign up for until you choose a plan.
What happens after the 14 days?
kosa8 is paid software: there is no permanently free tier, and we would rather you read that here than on day fifteen. Plans start at $29 a month, and paying yearly gets two months free. See the plans.
Does my code or data leave my machine?
No. Your code, files and prompts stay where the sandbox runs — your computer, your cloud, or an air-gapped network. kosa8 checks your licence, and plans with usage limits report counts (how many forks, snapshots, restores — never what ran), taken from an audit log you can verify yourself. An offline licence sends nothing at all.
Will it slow my agents down?
A container starts in 178 ms and a running sandbox restores in 897 ms, measured on real hardware. The honest exception: a folder shared from your computer reads at about a third of native speed, so keep heavy builds inside the sandbox.
Which computers does it run on?
Apple-silicon Macs and x86-64 Linux run sandboxes themselves; Windows 11 on x86-64 does too, through WSL2 (preview). An Intel Mac, Windows 10 or ARM, and JioOS pair with one of those in one command. Pick your platform.
Do I have to change how my team works?
No. The Docker CLI and Compose keep working, and ready-made kits run Claude Code, Codex, Gemini and other agents with one command: kosa8 agent run claude.
We are a regulated company. Can we use it?
That is who much of it was built for: FIPS 140-3 builds, signed org policies, two-person approvals, CUI labels, air-gapped operation and signed evidence packages. Talk to us about Enterprise & Government.
Give your next agent its own machine.
One line installs it. Fourteen days, every feature, no card.
Install
Works out which computer you have, checks the download, and puts kosa8 on your PATH.
Check the machine
Each check comes with the reason it matters and the command that fixes it.
Run an agent, sealed
A coding agent in its own VM, with nothing of yours it was not given.