Nono: Open-source sandbox for AI agents
An AI coding agent opens a terminal, reads a config file, and finds a live cloud key sitting in plaintext. It runs with the permissions of the person who launched it. Every file that person can read, the agent reads. Every credential in the environment, the agent can use.
That reach is where the damage starts. A prompt injection, a mistyped command, or a hallucinated path points that access at the company’s own credentials and production systems.
Luke Hinds built Sigstore at Red Hat, a signing project that became a standard for verifying where software packages come from. His company, nolabs, which he co-founded with Stephen Parkinson, released Nono, an open-source runtime that confines AI agents at the operating system kernel.
Nono has drawn more than 3,100 stars on GitHub. Over 80 people have contributed to it, and its users include large enterprises and teams in regulated industries.
The kernel gets the final say
Nono checks every action an agent takes against policies written in code. An agent asks to use a tool, open a file, or reach a network endpoint. The kernel returns the verdict. Enforcement sits in the operating system, below the agent and below any guardrail sharing its process.
Nono leans on Landlock on Linux and Seatbelt on macOS, kernel features that strip a process of privileges and hold them stripped. Once the sandbox applies, the limits stand for the life of the process.
“We currently support Windows via the Windows Subsystem for Linux (WSL2), which runs a real Linux kernel so Nono’s Landlock enforcement applies exactly as it does on native Linux. Native Windows enforcement is under active research,” Hinds told Help Net Security.
Developers reach for agents to move faster. Security teams watch those same agents inherit human-level permissions across files, credentials, and production systems. Containers and microVMs shrink the blast radius. An over-permissioned agent inside one still holds every key it was handed.
The tool gets a phantom key
Broad, session-long permissions are the problem Nono’s newer feature targets. Agent Tool Sandboxing hands each tool call its own scoped authority.
A tool receives a phantom credential standing in for a real secret. Its file access covers what the task needs. Its network reach ends at the endpoints it must hit. The authority expires when the call finishes.
A tool holding a phantom stand-in still has to authenticate against a live service somewhere. Hinds described how that call gets made: “Nono routes the request through a trusted proxy outside the sandbox, which retrieves the real credential from secure storage – such as the operating system’s keychain, 1Password, Bitwarden, or Kubernetes Secrets – and injects it only into the request sent to the approved external API.”
James Carnegie, a staff security engineer at Datadog, is one of its users: “Datadog engineers want their agents to move fast, and we want our credentials and production systems kept safe while they do. Nono is the only sandbox that gives us both fine-grained, per-command policies and sophisticated credential management that fits existing, complex real-world toolchains.”
Nono is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!