By Every AI coding agent running on your machine — Claude Code, GitHub Copilot, Codex, Cursor — inherits your full user-level permissions. That means your SSH keys, AWS credentials, .env files, and shell history are exposed every time an agent touches your terminal. On July 27, nolabs shipped Nono: an open-source runtime that sandboxes agents at the OS kernel level, with no container overhead, no VM, and effectively zero added latency.
This Is Already Happening
OpenClaw, an AI agent that hit 180,000 GitHub stars almost overnight, became 2026’s first major agent security crisis. Security researchers found 245,000 publicly accessible OpenClaw instances — connected to users’ email accounts, file systems, and cloud credentials, with no authentication required. The registry had 341 confirmed malicious skills out of 2,857 total. Three CVEs followed, including CVE-2026-44115 (CVSS 8.8): credentials leaking through unquoted heredocs, bypassing every framework-level filter in place.
Luke Hinds, co-founder of nolabs and creator of Sigstore, watched that unfold and built Nono as the response. Framework-level guardrails — allow-lists in markdown files, command blocklists, skill validation — live in userspace, alongside the thing they’re trying to constrain. The kernel cannot be tricked by a prompt.
How Nono Works
Nono uses OS-native security primitives: Landlock on Linux (kernel 5.13+) and Seatbelt on macOS — the same sandboxing mechanism Apple uses for App Store applications. Once a sandbox is applied, it is irrevocable. The policy cannot be loosened at runtime, no matter what an agent requests or what an attacker injects. Each agent starts with nothing: no filesystem access, no network, no credentials. You explicitly grant only what’s needed.
There is no container daemon, no image to pull, no VM to boot. The sandbox activates at process start and adds no measurable runtime overhead.
Getting Started
Install takes one command:
# macOS
brew install nono
# Linux
curl -fsSL https://nono.sh/install.sh | shNono ships with prebuilt profiles for every major coding agent. To run Claude Code sandboxed:
nono run --profile claude-code -- claudeThe prebuilt Claude Code profile covers filesystem read/write access scoped to your project directory, network access to Anthropic’s API, and standard toolchain runtimes (Node, Python, Rust). If you need custom boundaries:
{
"extends": "base",
"filesystem": {
"read": ["./", "~/.cache/agent"],
"write": ["./", "/tmp/agent-scratch"]
},
"network": { "allow": ["api.anthropic.com", "github.com"] },
"credentials": { "GITHUB_TOKEN": "keyring://github/token" }
}Your Secrets Never Touch the Agent
The credential proxy is Nono’s most important feature, and the easiest to overlook. Rather than injecting GITHUB_TOKEN into the agent’s environment, Nono routes requests through a trusted proxy that fetches the actual token from your keychain, password manager, or Kubernetes Secrets only at the moment it’s needed. The raw value is never exposed to the agent process. After use, memory is zeroed automatically.
This matters because credential exfiltration doesn’t require an agent to “go rogue” in a dramatic sense. A single prompt injection — injecting a malicious instruction into a file the agent reads — is enough to exfiltrate secrets if they’re sitting in the environment. With Nono, there’s nothing to exfiltrate.
Nono vs. Containers: Picking the Right Tool
Containers and microVMs are not wrong — they’re solving a different scope of problem. Here’s the honest comparison:
| Approach | Overhead | Setup | Bypass Risk | Best For |
|---|---|---|---|---|
| nono | ~0ms post-init | 1 command | Very low (kernel) | Local dev, credential protection |
| Docker/Podman | Daemon + images | Dockerfile + config | Medium (userspace) | Reproducible envs |
| Firecracker/microVM | 125ms+ boot | High | Lowest (full VM) | Multi-tenant, untrusted code |
If your threat model includes executing arbitrary untrusted code in a multi-tenant environment, use Firecracker. If you’re running your own agents on your own machine and want to keep them out of your credentials and unrelated files — which is most developers, most of the time — Nono is the right layer.
The Sigstore Playbook
Hinds built Sigstore at Red Hat: the open-source infrastructure that now signs 98% of npm packages and is embedded in container registries across the industry. The approach was community-maintained standards and shared infrastructure, not proprietary controls. Nono is following the same pattern for agent security — Apache 2.0 licensed, 3,100+ stars, 80+ contributors within days of launch.
If Sigstore’s trajectory is any guide, the question isn’t whether kernel-level agent sandboxing becomes standard practice. It’s whether your team adopts it before or after an incident forces the decision.
Nono is available now at nono.sh. The full technical breakdown covers audit logging, Ghost Sessions, and multi-fleet deployment.
