Safehouse: Secure Kernel-Level Sandboxing for AI Agents

Safehouse is a macOS-native sandboxing tool that protects your system from the unpredictable actions of local AI agents. It uses a kernel-level 'deny-first' model to restrict agent access to specific project files while blocking sensitive credentials. This lightweight script allows developers to run powerful AI tools with full autonomy without risking their private data or system integrity.

Key Points

• AI agents are probabilistic and carry a non-zero risk of performing destructive actions or accessing private data.
• Safehouse uses macOS-native kernel enforcement to provide a 'deny-first' access model for local agents.
• The sandbox automatically restricts agents to the current working directory while protecting SSH keys, credentials, and other repositories.
• It is a zero-dependency Bash script that works with leading AI agents like Claude Code, Aider, and Gemini CLI.
• Users can implement 'safe by default' workflows by aliasing agent commands to run within the Safehouse sandbox via shell configurations.

Sentiment

The HN community is broadly enthusiastic and supportive of Safehouse, agreeing that agent sandboxing is an important and underserved problem. While thoughtful critiques about limitations — particularly prompt injection and credential exposure — were raised, these were constructive additions rather than dismissals. The community validated the problem space and widely appreciated the tool's elegant simplicity and no-dependency approach.

In Agreement

• Filesystem-level sandboxing is a practical and necessary mitigation for accidental agent errors such as rm -rf, hard git reverts, or writing to wrong config files.
• A dependency-free shell script approach is elegant, transparent, and more trustworthy than heavy compiled binaries or complex frameworks.
• A universal sandboxer working across all agent CLIs (Claude Code, Aider, Cursor, Codex) is more maintainable than learning per-agent sandbox configurations.
• Kernel-enforced deny-first security is fundamentally more reliable than application-layer restrictions that an agent might reason its way around.
• The Policy Builder UI received specific praise for its excellent user experience in generating sandbox policies.
• macOS-native sandboxing fills a real gap for developers who need agents to run on their host machine with access to Apple-specific toolchains, keychain, and APIs.
• By default blocking sensitive credential directories like ~/.ssh and ~/.aws while granting only CWD access is the right security posture.

Opposed

• Filesystem sandboxing does not prevent prompt injection attacks where agent credentials are already loaded into memory before a malicious file is read — the sandbox is irrelevant once the agent has your AWS keys.
• sandbox-exec has been officially deprecated since macOS Sierra 2016, raising long-term reliability concerns despite still being actively used internally by Apple.
• Major agent CLIs like Claude Code already include built-in sandbox-exec configurations, making a wrapper of questionable marginal value for users who know how to configure them.
• A full macOS VM via Virtualization.framework or Lima provides stronger isolation with acceptable overhead for agentic workloads that are not performance-sensitive.
• The tool lacks network-level constraints, leaving agents free to reach any domain and exfiltrate data or spin up cloud resources.
• Overlay or copy-on-write semantics to allow agents to try changes without permanently modifying host files are not achievable with sandbox-exec on macOS.
• As of early 2026 agent reliability has improved enough through built-in guardrails that the urgency for additional external sandboxing layers has diminished for many users.