Trail of Bits open-sourced Coop, a virtual machine sandbox for coding agents

Trail of Bits has open-sourced Coop, a Rust command-line tool that puts Claude Code and Codex inside their own virtual machine so an agent that goes wrong can only damage a disposable copy of the project it was asked to work on. The repository was created on 2 April 2026, is Apache-2.0 licensed, and has 136 stars with 6 forks as of 8 September. It appeared on Hacker News yesterday with 51 points.

What Coop actually does

The tool starts one microVM per project directory. On Linux it uses Firecracker on top of KVM; on macOS it uses Lima, which runs a Linux guest under Apple's Virtualization framework. Each virtual machine gets its own filesystem, network stack and Docker daemon, and the getting-started doc states the constraint in a single line: "Agent CLIs never touch your host." The default machine is 2 vCPUs, 4 GiB of RAM and an 8 GiB template disk, and all three are configurable.

From inside the VM, the agent has a full Linux shell with git, compilers, package managers and Docker available. The user connects to it with commands that open Claude Code, Codex or a plain shell against the running instance. Coop treats the VM as project-oriented: the first invocation creates the instance, later ones reuse it, and stopping the machine lets it be restarted later rather than deleting it.

Where it fits

Docker is the obvious comparison, and one commenter on the Hacker News thread makes the case for Coop over it in one sentence: "VM isolation for your agents env." A container shares the host kernel; a Firecracker microVM does not. For an agent that is allowed to run arbitrary shell commands, that boundary matters, because the failure modes people worry about are commands that reach outside the project checkout, and a container is a weaker barrier than a virtual machine for that specific worry.

Another Hacker News user reported using Coop daily to keep agents "with no access to my other projects or personal files", and added the honest caveat that a motivated agent might still escape it. That is Trail of Bits' own framing: this is protection against accidents and a class of prompt-driven mistakes, not a hard security boundary against a hostile model.

Cost of adoption

The Linux path needs KVM and root, and the macOS path needs Apple Silicon plus Rosetta 2 and a working Lima install, so this is not a simple option for a team running Intel Macs or a locked-down laptop where KVM is not exposed. Windows is not listed as supported. Port forwarding and directory mounts exist but are opt-in, which is the whole point: the default is that the agent can reach nothing outside its own virtual machine.

Coop was pushed to as recently as yesterday, and there are 29 open issues, so it is a project in active development rather than a finished release. For a team that has moved coding-agent work from test laptops to real project folders, a per-project microVM is a smaller barrier than a shared cloud sandbox and a stronger one than a Docker container.

Source

trailofbits/coop on GitHub, with the getting-started doc and the Hacker News discussion. Star count and repository dates from the GitHub REST API, 2026-09-08.