Hazmat Locks AI Coding Agents Out of Your SSH Keys

Here is the uncomfortable default on most developer laptops: an AI coding agent runs as you. It has your SSH keys, your cloud credentials, your browser profile, your entire home directory — everything your shell can reach, it can reach. Hazmat, an open-source tool covered by Help Net Security on August 17, 2026, closes that gap without asking you to move your work into a container.

• Runs Claude Code, Codex, OpenCode, Cursor Agent, and custom scripts under a separate operating system user account
• Combines a kernel-enforced sandbox, a firewall rule, a DNS blocklist, and an automatic pre-session backup of the project
• Prints exactly what the agent can write to, read, and reach on the network before the session starts
• Free on GitHub, fully implemented on macOS with native Linux support; roughly 5.5% of the codebase is a TLA+ formal specification

How Hazmat Contains an AI Coding Agent

The mechanism is refreshingly old-fashioned, which is a compliment. Rather than inventing a novel permission layer, Hazmat leans on the isolation primitive every Unix system has had for decades: a different user account. The agent gets its own home directory and is granted access to exactly one project directory — the one you point it at. Your SSH keys, cloud credential folders, and dotfiles sit outside that boundary, enforced by the kernel rather than by the agent's good intentions.

On macOS the launch sequence runs four steps in order: back up the project, build a sandbox policy scoped to that single session, switch to the agent account, then start the agent harness with an active firewall rule. Nothing about that requires the agent to cooperate, which is the entire point. An agent that has been prompt-injected into exfiltrating credentials cannot reach credentials it was never given a path to.

Why the Pre-Flight Printout Matters

The feature most likely to change behaviour is the least technically impressive one. Before a session starts, Hazmat prints what the agent can access: which directories are writable, which are read-only, whether network access is on, and whether a backup was taken.

Security tooling that operates silently gets trusted blindly. Showing the blast radius before every run turns an abstract worry into a concrete, checkable list — and if the printout says something you did not expect, you find out before the agent starts writing files rather than afterwards. A runnable demo is included so you can watch the containment boundary hold rather than take it on faith. That principle of making the boundary legible is one of the recurring themes in our AI agent sandbox design coverage.

What Does TLA+ Verification Actually Prove Here?

About 5.5% of Hazmat's codebase is a formal specification written in TLA+, a language for describing how a system should behave so a machine can check the description for contradictions. The project describes its design as verified on that basis.

It is worth being precise about what that buys, because formal verification is often oversold. A TLA+ spec proves the design does not contain certain classes of logical error — a state where the sandbox policy is applied out of order, for instance. It does not prove the implementation matches the spec, and it does not prove macOS has no sandbox escapes. What it does signal is unusual seriousness for a free tool: someone sat down and wrote out what containment means precisely enough for a checker to argue with them.

Where Hazmat Fits in a Defensive Setup

The scope is deliberately narrow, and that is a strength. This is laptop-side containment for interactive coding agents. It is not a CI control, it is not an enterprise policy engine, and it does not replace the pipeline-level protections covered in our guide to securing AI coding agents in CI. It sits in the gap those tools do not cover: the several hours a day a developer spends running an agent locally against a real repository with real credentials sitting one directory up.

MacOS support is complete, Linux runs natively, and there is an experimental backend built on Apple's container tooling. For teams thinking about agent risk across their whole AI security posture, a free tool that makes local containment the default is a straightforwardly good addition — and the fact that it works with the agents people already use, rather than asking them to switch, is what will decide whether it actually gets adopted.

Sources: Help Net Security — August 17, 2026; Hazmat on GitHub — accessed August 17, 2026.