Trail of Bits has released Coop, an open-source tool designed to run AI coding agents like Claude Code and Codex inside isolated virtual machine environments. The tool addresses growing security concerns about AI agents having unrestricted access to host systems, a risk amplified by prompt injection and hallucination vulnerabilities in modern LLMs. By sandboxing agent execution, Coop aims to let developers leverage powerful coding assistants without exposing their entire development environment to potential compromise.
Security Architecture
Coop operates by spinning up lightweight, ephemeral VMs that serve as the execution environment for AI coding agents. The agent interacts with the codebase inside this isolated space, and only the resulting code changes are propagated back to the host system. This architecture prevents the agent from accessing sensitive files, executing arbitrary shell commands on the host, or exfiltrating data through unexpected network calls.
Target Use Cases
The tool is specifically designed for integration with Anthropic's Claude Code and OpenAI's Codex, two of the most popular agentic coding tools currently available. For teams working on proprietary codebases or security-sensitive projects, the ability to run these agents in a controlled environment is a significant operational improvement. Trail of Bits, known for their security research and auditing work, brings credibility to the tool's threat model and implementation.
Key Takeaways
- Coop provides VM-based isolation for AI coding agents, preventing host system access.
- The tool supports Claude Code and Codex, the leading agentic coding LLMs.
- Developed by Trail of Bits, a security firm with established credibility in the space.
- Open-source release encourages community review and adoption.
The Bottom Line
Running LLM agents with full host access is a security anti-pattern, and Coop finally offers a practical isolation layer for the most popular coding agents. Expect this to become a standard part of enterprise AI tooling stacks.