Trail of Bits open-sources Coop, a virtual-machine sandbox for Claude Code and Codex

Trail of Bits has open-sourced Coop, a Rust command-line tool that puts Claude Code and Codex inside their own virtual machine so an agent that goes wrong can only wreck a disposable copy of the project it was asked to work on. The repository was created on 2 April 2026, is Apache-2.0 licensed, and stands at 136 stars with 6 forks as of 8 September. It surfaced on Hacker News yesterday with 51 points.

What Coop actually does

The tool spins up one microVM per project directory. On Linux it uses Firecracker on top of KVM; on macOS it uses Lima, which runs a Linux guest under Apple's Virtualization framework. Each virtual machine gets its own filesystem, network stack and Docker daemon, and the getting-started doc states the constraint in a single line: "Agent CLIs never touch your host." The default box is 2 vCPUs, 4 GiB of RAM and an 8 GiB template disk, and all three are configurable.

From inside the VM, the agent has a full Linux shell with git, compilers, package managers and Docker available. The user connects to it with commands that open Claude Code, Codex or a plain shell against the running instance. Coop treats the VM as project-oriented: the first invocation creates the instance, later ones reuse it, and stopping the box leaves it restartable rather than wiping it.

Where it fits

Docker is the obvious comparison, and one commenter on the Hacker News thread makes the case for Coop over it in one sentence: "VM isolation for your agents env." A container shares the host kernel; a Firecracker microVM does not. For an agent that is allowed to run arbitrary shell commands, that boundary matters, because the failure modes people worry about are commands that reach outside the project checkout, and a container is a weaker fence than a virtual machine for that specific worry.

Another Hacker News user reported using Coop daily to keep agents "with no access to my other projects or personal files", and added the honest caveat that a motivated agent might still escape it. That is Trail of Bits' own framing: this is a fence for accidents and for a class of prompt-driven mistakes, not a hard security boundary against a hostile model.

Cost of adoption

The Linux path needs KVM and root, and the macOS path needs Apple Silicon plus Rosetta 2 and a working Lima install, so this is not a drop-in for a team running Intel Macs or a locked-down laptop where KVM is not exposed. Windows is not listed as supported. Port forwarding and directory mounts exist but are opt-in, which is the whole point: the default is that the agent has nothing outside its own box.

Coop was pushed to as recently as yesterday, and open issues sit at 29, so it is a project in active development rather than a finished release. For a team that has moved coding-agent work off staging laptops onto real project trees, a per-project microVM is a smaller fence than a shared cloud sandbox and a stronger one than a Docker container.

Source

trailofbits/coop on GitHub, with the getting-started doc and the Hacker News discussion. Star count and repository dates from the GitHub REST API, 2026-09-08.