In the rapidly evolving landscape of AI development, the power of coding agents comes with significant security risks. An AI coding agent opening a terminal, reading a config file, and discovering a live cloud key in plaintext is a realistic scenario. Such an agent operates with the same permissions as the person who launched it, granting it access to every file and credential available in the environment. This broad reach can lead to severe consequences, including prompt injections, mistyped commands, or hallucinated paths that inadvertently target a company's own critical systems.
Luke Hinds, renowned for building Sigstore at Red Hat—a signing project that became a standard for verifying software package origins—has co-founded nolabs with Stephen Parkinson. Their latest release, Nono, is an open-source runtime that confines AI agents at the operating system kernel level. Since its release, Nono has attracted over 3,100 stars on GitHub, with contributions from more than 80 individuals. Its user base includes large enterprises and teams in regulated industries, highlighting its practical utility in high-stakes environments.
The Kernel Gets the Final Say
Nono operates by checking every action an agent attempts against policies written in code. When an agent requests to use a tool, open a file, or reach a network endpoint, the kernel delivers a verdict. The enforcement mechanism resides in the operating system itself—below the agent and any guardrail that shares its process. This ensures that restrictions cannot be bypassed by the agent or any other software running at the same privilege level.
Under the hood, Nono leverages Landlock on Linux and Seatbelt on macOS—kernel features that strip a process of privileges and maintain those restrictions throughout the process lifecycle. Once the sandbox is applied, the limits are immutable. For Windows users, Nono currently supports the Windows Subsystem for Linux (WSL2), which runs a real Linux kernel, allowing Landlock enforcement to apply exactly as it does on native Linux. Native Windows enforcement is under active research, according to Hinds.
Addressing Over-Permissioned Agents
Developers often turn to AI agents to accelerate workflows, but security teams observe these same agents inheriting human-level permissions across files, credentials, and production systems. Traditional solutions like containers and microVMs can shrink the blast radius, but an over-permissioned agent inside one still holds every key it was handed. Nono tackles this problem with a newer feature called Agent Tool Sandboxing, which hands each tool call its own scoped authority.
Under this model, a tool receives a phantom credential that stands in for a real secret. Its file access covers only what the task needs, and its network reach ends at the specific endpoints it must hit. The authority expires immediately when the call finishes, preventing credential leakage or lateral movement. But a tool holding a phantom stand-in still needs to authenticate against a live service. Hinds explained how this works: "Nono routes the request through a trusted proxy outside the sandbox, which retrieves the real credential from secure storage—such as the operating system's keychain, 1Password, Bitwarden, or Kubernetes Secrets—and injects it only into the request sent to the approved external API."
This approach ensures that even if an agent is compromised, the actual credentials never touch the sandboxed environment. The real secrets remain under the control of dedicated vaults and are only released in a tightly controlled manner. This satisfies both the need for agent velocity and the security team's requirement to protect production assets.
User Perspective: Datadog
James Carnegie, a staff security engineer at Datadog, is one of Nono's users. He stated: "Datadog engineers want their agents to move fast, and we want our credentials and production systems kept safe while they do. Nono is the only sandbox that gives us both fine-grained, per-command policies and sophisticated credential management that fits existing, complex real-world toolchains." This endorsement from a major cloud monitoring company underscores Nono's viability in demanding enterprise environments.
Background and Context: The Rise of AI Agent Security
The emergence of large language models (LLMs) and their integration into development workflows has created a new attack surface. As AI agents become more autonomous—capable of writing code, modifying files, and interacting with production services—the risk of unintended actions grows. Traditional security measures like network segmentation and role-based access control often fall short because agents operate with human-level credentials over long-lived sessions. The concept of a "sandbox" for AI agents is not new, but most existing solutions work at the application layer, such as function-level guards or prompt filters. Nono's approach is distinct by enforcing restrictions at the kernel layer, which makes it more resilient to adversarial prompts and agent bugs.
Kernel Sandboxing: Landlock and Seatbelt
Landlock, introduced in Linux 5.13, is a security module that allows unprivileged processes to sandbox themselves. Unlike traditional security modules like SELinux or AppArmor—which require system-wide policies set by an administrator—Landlock lets applications define their own restrictions. Seatbelt is the macOS equivalent, originally part of the macOS sandbox framework. Both use a deny-by-default model: the process starts with full privileges and then invokes the sandbox to drop capabilities. Nono wraps these kernel features into an easy-to-use policy language, allowing developers to specify exactly which files, directories, network endpoints, and system calls an agent can access.
Comparison to Other Approaches
Many teams rely on containerization to isolate agents. However, containers share the host kernel and can be vulnerable to container escape exploits if not carefully configured. MicroVMs (like Firecracker or gVisor) provide stronger isolation but often at the cost of performance and compatibility. Nono strikes a balance: it runs in the same namespace as the agent but hooks into the kernel's permission checks. This leads to near-zero overhead while still offering granular, kernel-enforced control. Additionally, because Nono works at the process level, it can sandbox individual tool invocations without requiring a full VM boot for each action.
Credential Management: A Critical Piece
The phantom credential pattern is a key innovation. Many organizations store secrets in dedicated vaults like HashiCorp Vault, AWS Secrets Manager, or cloud keystores. When an agent needs to call an external API, it often has to either carry long-lived tokens or fetch them from the vault at startup. Nono's proxy model eliminates both risks: the agent never holds a real secret, and the proxy validates the specific API endpoint before injecting the credential. This is particularly important in regulated industries like finance and healthcare, where audit trails and minimal access are mandatory.
Open-Source Community and Adoption
Nono's GitHub repository has quickly become a hub for collaboration. With over 3,100 stars and 80+ contributors, the project benefits from a diverse set of maintainers and testers. Large enterprises have adopted Nono to secure their internal AI agents, and the community has contributed integrations with popular agent frameworks like LangChain and AutoGPT. The Apache-2.0 license ensures that anyone can use, modify, and distribute the software without restrictions, fostering widespread adoption. Luke Hinds' reputation from Sigstore has also lent credibility to the project, as security engineers trust his approach to building production-grade, open-source tools.
Challenges and Future Directions
While Nono excels at Linux and macOS, Windows support remains limited to WSL2. The team is actively researching native Windows enforcement, likely using Windows Defender Application Control or similar kernel mechanisms. Another challenge is the complexity of defining policies for diverse toolchains—Hinds and Parkinson have focused on making the policy language declarative and easy to test. Nono's roadmap includes deeper integration with container orchestrators, support for eBPF-based monitoring, and improved debugging tools to help developers understand why an agent action was blocked. The goal is to make security invisible to the user while maintaining rigorous enforcement.
Practical Implications for Security Teams
For security teams, Nono provides a way to embrace AI agents without compromising on safety. Instead of trying to predict every potential attack path, they can define policies that limit agents to specific actions. The per-tool sandboxing means that even if an agent is tricked into running malicious code, the damage is contained to the scope of that single tool call. This aligns with the principle of least privilege and supports incident response by providing detailed logs of every denied or allowed action. The open-source nature also means that security teams can audit the codebase and customize policies to their unique environments.
Nono is available for free on GitHub, allowing any organization to download, inspect, and deploy it. The project's documentation includes guides for integrating with various secret stores, writing custom policies, and monitoring agent activity. As AI agents become more common in software development, infrastructure management, and even customer-facing applications, kernel-level sandboxing tools like Nono will become an essential part of the security stack.
Source:Help Net Security News