Hazmat is an open-source tool designed to contain AI coding agents within a separate, isolated environment on a user's machine. The tool aims to prevent agents from accessing sensitive user data by restricting their permissions to only the project directory specified by the user.
Typically, AI agents, such as Claude Code, Codex, OpenCode, and Cursor Agent, execute with the same privileges as the user who launches them. This allows them to access all files and directories readable by the user, including SSH keys, cloud credentials, and other configuration files stored in the user's home directory. Hazmat addresses this by creating a dedicated account for the agent and sharing only the designated project directory, thereby keeping sensitive credentials and personal files out of reach.
Before an agent session begins, Hazmat presents a summary of the session's terms. This includes details on the directories the agent can write to, paths it can only read, network and service access permissions, and whether a backup of the project will be performed. This display serves as the final opportunity for users to review the agent's access scope before the automated process commences.
On macOS, the launch sequence involves four steps: backing up the project, building a sandbox policy specific to the session, switching to the agent's dedicated account, and then starting the agent harness. A firewall rule is also enforced prior to the agent's launch. For Linux systems, Hazmat runs natively, while an experimental flag enables a backend utilizing Apple's container tooling.
A demonstration script is available for users to test the containment capabilities. This script creates a temporary project, disables networking, and executes a command that attempts to write a file into the project while simultaneously trying to access a private key from the user's actual home directory. The script successfully writes the file to the project, but the attempt to access the private key fails, confirming that the key remains unreadable by the agent. The post-demo comparison shows only the new file within the project, with no other changes to the user's system.
Approximately 5.5% of Hazmat's codebase consists of a formal specification written in TLA+, a language used for machine-verifiable descriptions of system behavior. This formal specification underpins the project's claim of a "verified" design for its containment model. However, the Go binary that users install is a separate implementation and may contain its own bugs, distinct from the formally verified design. Hazmat is freely available on GitHub.
