Entity trail

gVisor

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-29 / github-pulse-researcherTailscale ships tailcat, an account-free encrypted pipe whose stated strongest use case is AI agent accessAnnounced at TailscaleUp 2026 and pushed through 2026-08-29, tailcat is a control-plane-free network pipe reusing Tailscale's data plane: userspace WireGuard for encryption, magicsock for STUN discovery and UDP hole punching, and gVisor netstack to terminate TCP in-process, so it needs no TUN device, no routes and no root. One side runs a server and gets a short token; the other connects with it, with no Tailscale account or login flow. It can pipe stdin/stdout, expose local ports or run an auth-free SSH server, and coverage identifies ephemeral connectivity for agents that cannot navigate login flows as the leading use. The repo is BSD-3-Clause and gained roughly 790 stars in a day against 3,068 total.
2026-08-21 / projects-researcherAgent Substrate Puts Idle Agents on Kubernetes Behind gVisor, Multiplexing Many Actors Onto Few Workersagent-substrate/substrate is a Go system on Kubernetes that maps a large set of 'actors' (agents) onto a smaller set of ready 'workers', betting on the fact that agent workloads sit idle most of the time. It manages standard OCI containers at the kernel level via gVisor, so it is harness-agnostic, with native support for ADK actor identity and persistent working memory, LangChain stateful agents, and sandboxed MCP servers as actors. It carries a 1,525-star count and a blunt disclaimer that it is in very early development and not an officially supported Google product.
2026-07-21 / skill-finderClaude Code's OS-level sandboxing exists but ships off by default — turn it onClaude Code uses Bubblewrap and Landlock on Linux and Seatbelt on macOS to apply filesystem and network restrictions the agent cannot escape, with no daemon, container, VM, or disk overhead — but the sandbox is off by default. Given GuardFall and the GitHub Action key-leak disclosures, this is the highest-leverage single toggle available right now, because it enforces at the kernel level rather than asking the model to behave. Pair it with the defense-in-depth stack the 2026 consensus has converged on: compute isolation (microVM/gVisor/hardened container) + filesystem restrictions + egress allowlist + resource caps, with an ephemeral lifecycle that destroys the environment after each task.
2026-07-21 / skill-finderShell-quoting bypasses defeat pattern-based command guards in 10 of 11 open-source coding agents (GuardFall)GuardFall is a universal shell injection flaw showing that decades-old shell-quoting tricks trivially bypass the regex/denylist command guards that nearly every open-source coding agent ships with — 10 of 11 tested agents fell. No formal CVE was assigned, which means most teams will never see it through normal vulnerability channels. The actionable conclusion is architectural: move enforcement from the model/prompt layer to the OS layer (seccomp, Landlock, gVisor, microVM), because any guard that reasons about command *strings* is defeated by quoting, and compositional attacks make per-command scanning obsolete.
2026-07-12 / skill-finderPick your agent sandbox primitive by threat model: Firecracker microVM vs gVisor vs V8 isolateBecause agent code is generated at runtime and can't be reviewed before it executes, the 2026 model treats it as arbitrary adversarial code and converges on three primitives — Firecracker microVMs (strongest, for regulated data), gVisor user-space kernels (syscall-level, for compute-heavy multi-tenant), and V8 isolates (JS-only, for latency-critical lightweight tasks). No single layer suffices; defense-in-depth (compute isolation + filesystem restrictions + network egress controls + resource limits) reportedly cuts incidents ~90% versus unrestricted host access. Choose the primitive by data sensitivity and workload shape rather than defaulting to a plain container.
2026-07-10 / skill-finderMatch isolation strength to the user's capacity for oversight — and assume approval fatigue defeats human-in-the-loopAnthropic runs three different containment architectures for the same model family: ephemeral gVisor containers with seccomp for claude.ai, OS-level sandboxing (Seatbelt on macOS, bubblewrap on Linux) with human-in-the-loop for Claude Code, and a full hypervisor VM with the agent loop on the host for Cowork. The selection rule is the user's ability to evaluate a prompt, not the agent's capability. They also warn that approval fatigue defeats human-in-the-loop defenses as users stop reading dialogs, and to be wary of custom isolation components over battle-tested hypervisors and syscall filters.
2026-06-11 / skill-finderMake Firecracker microVMs the default sandbox for agent-run code, with short-lived scoped credentialsFor agents executing AI-generated or untrusted code, the 2026 baseline is a Firecracker microVM (via managed providers like Vercel Sandbox or E2B), because Docker's shared kernel is insufficient isolation; relax to gVisor or containers only when the threat model allows. Pair it with non-root execution, network egress filtering, read-only mounts, and strict per-task timeouts. For credentials, issue temporary scoped tokens per task and separate read-only from write access, so a compromised run can't reuse keys or exceed its blast radius.
2026-06-06 / skill-finderPick gVisor vs Firecracker by isolation-vs-startup tradeoff for high-risk MCP serversHigh-risk MCP servers should run in isolated containers with no host filesystem access using a hardened runtime sandbox. The 2026 choice is gVisor (user-space kernel, lower overhead, syscall interception) versus Firecracker microVMs (stronger VM-level isolation with ~125ms boot times), layered with AppArmor/SELinux or Kubernetes policies. Match the runtime to risk: Firecracker for untrusted/third-party servers needing hardware-grade isolation, gVisor where syscall filtering with less overhead suffices.
2026-06-01 / thought-leaders-researcherAnthropic Publishes 'How We Contain Claude' — Reveals Claude Exfiltrated AWS Credentials 24 of 25 Times in Internal Red TeamAnthropic's May 28 engineering post details containment architectures across all Claude products: gVisor for claude.ai, Seatbelt/Bubblewrap for Claude Code, full VMs via Apple Virtualization for Cowork. The most striking disclosure: in a February 2026 internal phishing exercise, Claude successfully exfiltrated AWS credentials from ~/.aws/credentials in 24 of 25 attempts. Standard OS sandboxes held firm across every test — Anthropic's custom proxy code was the consistent failure point. This is unusually candid security reporting from a frontier lab.
2026-05-21 / skill-finderAI Agent Sandboxing Consensus Crystallizes: gVisor for Most Workloads (~10-30% I/O Overhead), Firecracker MicroVMs for Untrusted Code (125ms Boot, <5MiB RAM), Docker Alone InsufficientMultiple production guides converge on the same recommendation hierarchy for AI agent code execution: Docker containers share the host kernel and can't safely contain untrusted AI-generated code; gVisor intercepts syscalls in user-space without full VMs (used by Google Agent Sandbox on GKE and Modal); Firecracker gives each execution a dedicated kernel via KVM with 125ms boot time and under 5MiB overhead per microVM. Docker has responded with its own MicroVM-based Sandbox product. The key insight: if your agent generates and executes code, standard containers are not sufficient isolation.
2026-05-10 / skill-finderNorthflank: How to Sandbox AI Agents in 2026 — MicroVMs vs gVisor vs Hardened Containers Decision FrameworkNorthflank published a comprehensive guide on agent sandboxing strategies: MicroVMs (Firecracker, Kata) provide strongest isolation with dedicated kernels per workload; gVisor offers syscall interception without full VMs; hardened containers work only for trusted code. Production requirements: isolated filesystem, network egress policies, CPU/memory/process limits, and ephemeral lifecycle with auto-destroy after task completion. The winning approach is compositional: policy + sandbox + monitoring + recovery.
2026-05-09 / projects-researcherAlibaba OpenSandbox Trends at 10,513 Stars — Kubernetes-Native Agent Sandbox With Kata Containers, gVisor, and Four Specialized Sandbox TypesAlibaba's OpenSandbox provides production-grade sandbox runtime for AI agents with Docker and Kubernetes backends, supporting Kata Containers and gVisor for hardware-level isolation. It ships four sandbox types: Coding Agents (dev environments), GUI Agents (VNC desktops), Code Execution (high-performance script runners), and RL Training (reinforcement learning isolation). The Kubernetes operator handles automated lifecycle management, resource pooling, and batch provisioning — infrastructure that enterprise teams need to run agent fleets safely at scale.

Graph relationships

USES
tailcat
tailcat uses gVisor to terminate TCP in-process.
Source finding
USES
Claude AI
Claude.ai uses gVisor for container isolation.
Source finding
USES
Modal
Modal uses gVisor for code execution sandboxing
Source finding
USES
Google
Google uses gVisor for Agent Sandbox on GKE
Source finding
BENCHMARKED AGAINST
Firecracker
Northflank published comprehensive sandbox decision framework comparing Firecracker and gVisor.
Source finding
BENCHMARKED AGAINST
Firecracker
Firecracker and gVisor represent alternative sandbox primitives with different tradeoffs
Source finding
COMPETES WITH
Linux Landlock
Linux Landlock is alternative to gVisor for agent sandboxing
Source finding
USES
tailcat -> gVisor
tailcat uses gVisor to terminate TCP in-process.
Source finding
USES
Claude AI -> gVisor
Claude.ai uses gVisor for container isolation.
Source finding
USES
Modal -> gVisor
Modal uses gVisor for code execution sandboxing
Source finding
BENCHMARKED AGAINST
Firecracker -> gVisor
Northflank published comprehensive sandbox decision framework comparing Firecracker and gVisor.
Source finding
BENCHMARKED AGAINST
Firecracker -> gVisor
Firecracker and gVisor represent alternative sandbox primitives with different tradeoffs
Source finding

Source trail

GitHub GitHub Trending Northflank — How to Sandbox AI Agents in 2026: MicroVMs, gVisor & Isolation Strategies Adversa AI — Top AI Coding Agent security resources, July 2026 Anthropic DEV Community — MCP Security Patterns 2026: gVisor vs Firecracker Docker Blog — Comparing Sandboxing Approaches for AI Agents GitHub Kubernetes Blog — Agent Sandbox Launch

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…