Guides · updated 2026-10-31
Running AI agents safely, one question at a time.
Each guide answers one question developers ask about giving AI agents real machines: how to isolate them, undo what they did, limit what they can reach, and keep API keys out of their hands. Every command shown is checked against kosa8's own CLI, and each guide names the other options fairly.
How do I run Claude Code safely on a Mac?
Keep Claude Code in Manual or acceptEdits mode, turn on /sandbox (macOS Seatbelt), and for a hard boundary run it in a microVM with its own kernel.
read →Docker containers vs microVMs: which isolates an AI agent better?
A microVM isolates an AI agent more strongly: it runs on its own guest kernel behind a hypervisor, while a container shares the kernel of the host it runs on.
read →How do I undo what an AI coding agent did?
Use git to undo an AI agent's file edits, and a whole-machine checkpoint for what git misses: installed packages, outside files, databases and processes.
read →How do I run untrusted LLM-generated code safely?
Run it behind a real isolation boundary with no secrets inside, an allow-listed network, CPU and memory caps, rewindable state and an audit log.
read →How do I restrict an AI agent's network access to an allow-list?
Deny all outbound traffic by default, allow only listed hosts, and enforce it outside the agent's machine with DNS answered there; DNS or proxy filters leak.
read →How do I give an AI agent API keys without exposing them?
Keep the key out of the agent's environment: give it a placeholder and let a host-side egress proxy swap in the real key on the way out to one allowed API.
read →How do I run MCP servers in a sandbox?
Run each MCP server in its own microVM reaching only the hosts it needs, behind a gateway that pins tool definitions, so a bad server cannot reach your files.
read →How do I run an AI agent sandbox on my own machine instead of the cloud?
Install a local sandbox runtime such as kosa8, start its daemon and create a microVM for the agent. Code, data and keys stay on your hardware, even offline.
read →How do I try several AI agent approaches in parallel?
Fork the agent's sandbox after setup, run one approach per live copy at the same time, compare exit codes and timings, and keep the copy that worked.
read →How do I require human approval before an AI agent runs a risky command?
Hold risky AI agent calls such as force pushes, deploys, payments and deletes until a person approves that exact call, and record each decision in an audit log.
read →How do I run an AI coding agent fully air-gapped?
Carry the installer, guest image, container images and model across the gap, serve the model on 127.0.0.1, and point the agent at it. Nothing leaves.
read →Is it safe to use claude --dangerously-skip-permissions?
Only inside an isolated machine. The flag turns off Claude Code's permission prompts, so run it in a VM or container that sees one folder and holds no keys.
read →How do I block dangerous commands with Claude Code hooks?
Add a PreToolUse hook on Bash that exits with code 2 to block a command, back it with deny and ask rules, and know that text matching can be bypassed.
read →How do I use Cline auto-approve and YOLO mode safely?
Auto-approve only Cline's project reads at first, keep the all-files and all-commands toggles off, and use YOLO mode only in an isolated VM or throwaway box.
read →How do I point a coding agent at a local model?
Serve a model with kosa8 model serve and set the agent's base URL to 127.0.0.1:7434. Aider fits, and since v0.11.0 tool-calling agents can use it too.
read →How do I sandbox CrewAI code after CodeInterpreterTool?
CodeInterpreterTool is gone and allow_code_execution is deprecated. Give the agent a custom tool that runs code in a local microVM with no network instead.
read →How do I use Cursor's YOLO mode without risking my machine?
Keep Cursor's sandbox on, commit before each task, and use Run Everything or --yolo only where the agent reaches nothing you would miss, such as a separate VM.
read →How do I sandbox LangChain and LangGraph code execution?
Swap PythonREPLTool for a tool that runs code in a sealed microVM with no network, and add a LangGraph interrupt() so a person approves each run.
read →How do I give the OpenAI Agents SDK a local sandbox?
Use the SDK's DockerSandboxClient and set DOCKER_HOST to kosa8's socket: the sandbox becomes a container in a microVM on your own Mac or Linux machine.
read →How do I run OpenHands in a sandbox safely?
Keep OpenHands on its default Docker sandbox, publish the UI on 127.0.0.1 only, mount just the project, and isolate the Docker host the app controls.
read →Is Aider safe? How do I run Aider in a sandbox?
Aider commits each edit to git so /undo works, but it also runs shell commands. Run it in a container or VM with one folder and a limited network.
read →How do I run Claude Code safely on Linux?
Install bubblewrap and socat for Claude Code's /sandbox, make it fail closed, and for a hard boundary run it in a KVM microVM that sees one folder and no key.
read →How do I run Claude Code safely on Windows with WSL2?
Run Claude Code inside WSL2 and turn on /sandbox, which native Windows and WSL1 lack. For a VM boundary, kosa8 runs a microVM through WSL2 (preview).
read →How do I run Codex CLI safely?
Keep Codex in workspace-write with on-request approvals and the network off. Use danger-full-access or --yolo only inside a VM you are prepared to lose.
read →How do I run a coding agent unattended overnight safely?
Give the agent its own VM and branch, cap turns and spend, checkpoint as it works, let risky calls wait for a person, and read the audit log before you merge.
read →How do I run Gemini CLI in a sandbox?
Start Gemini CLI with -s or set GEMINI_SANDBOX (Seatbelt, Docker, Podman). For its own kernel, an allow-listed network and a brokered key, use a microVM.
read →How do I build a self-hosted code interpreter for my LLM?
Run model-written code in a VM you control: no network, a read-only input folder, a writable output folder, time limits and a rewind after every run.
read →How do I make smolagents code execution secure locally?
Set executor_type="docker" and point DOCKER_HOST at kosa8: CodeAgent's Python then runs in a container inside a microVM on your machine, not in your process.
read →How do I stop an AI agent from deleting my files?
Commit first, give the agent one folder, hold rm -rf, git clean and git reset --hard for approval, and run it in a VM where the rest of your disk is absent.
read →How do I stop AI coding agents from reading my .env secrets?
Move real keys out of the folder the agent works in. Ignore files miss shell commands and scripts; a proxy that swaps in the key leaves nothing to read.
read →How do I run Vercel AI SDK agent code in a local sandbox?
Install @kosa8/ai-sdk-sandbox, create a session and pass session.restricted() as experimental_sandbox: your tools then run in a microVM on your machine.
read →Looking for every flag? See the kosa8 docs and every command.