Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-17 · high
The open-source tool sandboxes each agent's file and network reach instead of letting it run with your full account.
Why now: Help Net Security covered the project on August 17.
Hazmat gives each coding agent its own macOS user account, a kernel-enforced sandbox, a firewall, and a DNS blocklist, per Help Net Security's August 17 coverage. Before a session starts, it prints exactly which paths the agent can write to, which it can only read, and what network access it gets. It also takes an automatic backup before each session.
The problem it targets is the one most people using coding agents skip past. Launch an agent the normal way and it runs as you, with your account's full reach. Every SSH key and cloud credential sitting in your home directory is fair game if the agent goes wrong or gets prompted into doing something it shouldn't.
The repo, dredozubov/hazmat, was created March 27 and sits at 128 stars as of the August 17 coverage. That's early. Small user base, not much of a track record yet. What stands out is the TLA+ verification, a formal method usually reserved for systems where a bug can't be patched later, not a side project a few hundred people have starred.
I don't run agents under a separate OS user. I trust the sandboxing my tools already do and I've never had one touch something it shouldn't. But I also haven't audited what my home directory actually exposes if one did. Hazmat's real contribution isn't the tool, it's naming the exposure out loud: if you're running coding agents locally, you already know what's in reach. The question is whether you've looked.
Each link below shares sources, entities, or timing with this story.
Shared entity: Help Net Security / Same source domain / Shared topic / Earlier coverage / Tension
Both cover Help Net Security; reported by the same outlet (helpnetsecurity.com); overlapping topics (agent, coding).
Shared entities / Same source domain / Earlier coverage
Both cover Help Net Security, March; reported by the same outlet (helpnetsecurity.com); earlier Help Net Security coverage from 2026-08-15.
Shared entities / Shared topic / Earlier coverage
Both cover Help Net Security, SSH; overlapping topics (agent, coding); earlier Help Net Security coverage from 2026-06-07.
Shared entities / Same source domain / Earlier coverage
Both cover March, SSH; reported by the same outlet (helpnetsecurity.com); earlier March coverage from 2026-03-28.
Shared entity: Help Net Security / Same source domain / Shared topic / Earlier coverage
Both cover Help Net Security; reported by the same outlet (helpnetsecurity.com); overlapping topics (agent, coding).
Both cover Help Net Security; reported by the same outlet (helpnetsecurity.com); overlapping topics (agent, coding).
Both cover Help Net Security; reported by the same outlet (helpnetsecurity.com); overlapping topics (account, agent).
Shared entity: Help Net Security / Same source domain / Earlier coverage / Tension
Both cover Help Net Security; reported by the same outlet (helpnetsecurity.com); earlier Help Net Security coverage from 2026-07-28.