Sandboxes
Run coding agents in governed sandboxes.
The developer keeps the command. The organization keeps the boundary.
In early access, claude and codex run on a remote machine your organization defines: the repositories, the network, the tools, the models, and the record.
The laptop holds everything the agent can reach.
A coding agent on a developer machine sits beside SSH keys, cloud credentials, and every checkout. A prompt or classifier may stop a bad command, but it does not reduce the authority already present on that machine.
- credentials taken from 1,079 developer machines in one attack
- 2,349
- secrets leaked across 487 organizations by the next one
- 14,000
- of published agent skills scanned were malicious
- 11.9%
The same command, off the developer laptop.
Type what you type today
Start the session from the repository directory. Same terminal, same shortcuts, same full screen.
Close the lid, keep the session
The session lives on the remote machine. Reattach and it is where you left it.
Your checkout stays yours
The agent works on the branch in the sandbox. Your editor keeps its own copy.
Example — fictional team and data. Not a live run or customer result.
Developer terminal
Live- claude
- sandbox ready · policy "Engineering default" v7 · egress restricted
- Claude CodeReading src/billing/invoice.ts
- Claude CodeEdit src/billing/invoice.ts
- Blocked by policy: api.unknown-host.dev
- Claude CodeRan tests · 41 passed
One policy decides what a session can reach.
Repositories and network
Name the repositories a session may clone and the hosts it may call. Everything else is refused and recorded.
Choose how credentials enter
Gateway mode gives the session placeholders instead of brokered keys. Developer-subscription sign-in stays inside the encrypted sandbox snapshot.
Tools, skills, and spend
Set the MCP servers, skills, instructions, models, and budget a session gets. It cannot add its own.
Example — fictional team and data. Not a live run or customer result.
Sandbox policy
Engineering default · v7
- Repositories
- acme-api, acme-web
- Network
- Restricted · 12 hosts
- Credentials
- Brokered · 0 in sandbox
- MCP servers
- Aestus, GitHub
- Skills
- Org catalog · 9
- Models
- 3 allowed
- Budget
- 8h / developer / week
Scale the work. Keep the reach small.
Assume a command will be wrong someday. Each session starts with only the access its job needs, enforced outside the agent. Aestus applies the same policy across the fleet.
Constrain damage before the first command
The enforced policy lives outside the agent. A changed mode cannot add a repository, reveal a credential, or open an unlisted host.
One policy, many sandboxes
Pin the image, agent versions, tools, and access once. Each developer starts from the same known setup instead of hand-tuning another laptop.
Stop idle compute, keep state
Snapshot the installed environment, stop compute when work pauses, and restore it on return. Set time and spend limits before a session starts.
Every session is a run you can replay.
A session opens a run record: the terminal recording, the tools it called, the requests the boundary refused, and what it cost. One stream of evidence, kept with the work.
Measure risk and cost from the same run.
- Real credentials inside the sandbox
- The target is zero: access is attached only when a request leaves.
- Requests refused at the boundary
- Network and credential calls stopped by policy.
- Active hours by developer and repository
- Running time charged against the budget before another session starts.
Anthropic and OpenAI already ship sandboxes.
They provide useful local protection. But local modes, exceptions, and tools still depend on controls on a developer-owned machine. Aestus moves the whole agent session to an organization-governed machine, where repository, network, credential, and tool access are set outside the agent.