Sandbox

Hardware isolation

Each agent session boots its own microVM — a full Linux kernel (6.12.x) running on Apple Hypervisor.framework via libkrun — and is destroyed on exit. No state persists between sessions. No lateral movement to the host is possible because the guest kernel is separate. The agent never shares the host kernel.

The agent process runs as unprivileged UID 1000. The Linux capability bounding set is zeroed before the UID drop, so no SUID binary in the sandbox can escalate. Privilege-escalation paths are absent by construction, not by restriction.

Deny-all egress

Network egress is blocked at two independent layers: a hypervisor-level connection intercept (TSI) that catches all TCP before kernel routing — with no user-space bypass path, including for statically linked binaries that ignore proxy environment variables — and network namespace isolation inside the guest that blocks ICMP, UDP and raw sockets. Allowed hosts are declared explicitly in policy. Every connection is logged with its verdict.

Deny-all is the starting position, not the operating state. In practice:

• The shipped baseline policy permits what a coding agent needs — curated bundle sets for npm, PyPI, cargo, Go modules and apk, plus source control, model API endpoints and your own internal domains. Nobody starts from an empty allowlist.
• Deployment starts in monitor mode with nothing blocked. RayShield records every destination your agents reach for. You derive an allowlist from observed behaviour and decide what to enforce.
• Policy is a TOML file in source control, pushed centrally without a reinstall. Approval can be delegated per team.
• A denied connection returns an explicit error the agent can read. Sessions do not hang or fail silently.

[base]
allow_hosts = [
  "api.anthropic.com:443",   # model API
  "github.com:443",          # source control
  "api.github.com:443",      # GitHub REST
  "*.internal.acme.com",     # your services
]

[egress]
bundles = ["npm", "pypi"]    # package registries
mode    = "monitor"          # monitor | warn | block

Binary attestation

Every tool binary is SHA-256 hashed and Ed25519-signed into a manifest at deploy time. The guest supervisor (sentry, running as PID 1) re-verifies the manifest at boot before executing anything. A single-bit change in any binary breaks the hash and the session is refused. Binary substitution and supply-chain tampering stop the session rather than running it.

The signing keys are named in policy, not hardcoded — multi-key trust is supported for teams with multiple deploy authorities.

Kernel-level audit

The guest supervisor intercepts process-execution and network-connection syscalls in real time via seccomp USER_NOTIF. It reads the full argv and target address directly from /proc/pid/mem — not from any log the agent produces. A TOCTOU guard (NOTIF_ID_VALID) prevents the agent from swapping its own argv between the intercept and the read.

The result is a tamper-evident record of what the agent ran and what it tried to reach, produced independently of anything the agent reports about itself. A self-reported log is not evidence. This is.

Behavioural detection

A deterministic correlator runs over the agent's action stream and fires named, rule-ID-tagged detections. Rules are TOML data — not a scoring model. Inline base64 and hex are decoded before matching, so obfuscated commands trip the same rule as the clear-text equivalent.

The same correlator and rule set runs on all three MITM surfaces — sandbox, endpoint (Claude Desktop/CLI) and Cowork. Add a rule once and it fires everywhere.