An AI coding agent opens a terminal, reads a config file, and finds a live cloud key sitting in plaintext. It runs with the permissions of the person who launched it. Every file that person can read, the agent reads. Every credential in the environment, the agent can use. That reach is where the damage starts. A prompt injection, a mistyped command, or a hallucinated path points that access at the company’s own credentials and production systems.
Luke Hinds built Sigstore at Red Hat, a signing project that became a standard for verifying where software packages come from. His company, nolabs, which he co-founded with Stephen Parkinson, released Nono, an open-source runtime that confines AI agents at the operating system kernel. Nono has drawn more than 3,100 stars on GitHub. Over 80 people have contributed to it, and its users include large enterprises and teams in regulated industries.
The kernel gets the final say
Nono checks every action an agent takes against policies written in code. An agent asks to use a tool, open a file, or reach a network endpoint. The kernel returns the verdict. Enforcement sits in the operating system, below the agent and below any guardrail sharing its process. Nono leans on Landlock on Linux and Seatbelt on macOS, kernel features that strip a process of privileges and hold them stripped. Once the sandbox applies, the limits stand for the life of the process.
Landlock is a Linux security module that allows unprivileged processes to create restricted sandboxes. It was merged into the Linux kernel in version 5.13. Seatbelt is macOS's built-in sandbox mechanism, which uses a kernel extension to enforce rules. Nono uses these to provide a lightweight but powerful isolation layer. Unlike containers, which share the host kernel and rely on namespaces, Nono enforces policy at the system call level, catching operations that containers might miss.
“We currently support Windows via the Windows Subsystem for Linux (WSL2), which runs a real Linux kernel so Nono’s Landlock enforcement applies exactly as it does on native Linux. Native Windows enforcement is under active research,” Hinds told Help Net Security.
Developers reach for agents to move faster. Security teams watch those same agents inherit human-level permissions across files, credentials, and production systems. Containers and microVMs shrink the blast radius. An over-permissioned agent inside one still holds every key it was handed. This is where Nono differentiates itself by operating at the kernel layer rather than at the application or container orchestration level.
The tool gets a phantom key
Broad, session-long permissions are the problem Nono’s newer feature targets. Agent Tool Sandboxing hands each tool call its own scoped authority. A tool receives a phantom credential standing in for a real secret. Its file access covers what the task needs. Its network reach ends at the endpoints it must hit. The authority expires when the call finishes.
A tool holding a phantom stand-in still has to authenticate against a live service somewhere. Hinds described how that call gets made: “Nono routes the request through a trusted proxy outside the sandbox, which retrieves the real credential from secure storage – such as the operating system’s keychain, 1Password, Bitwarden, or Kubernetes Secrets – and injects it only into the request sent to the approved external API.” This approach ensures that even if the agent is compromised, the attacker cannot extract the real credential. The phantom credential is ephemeral and scoped, reducing the attack surface dramatically.
James Carnegie, a staff security engineer at Datadog, is one of its users: “Datadog engineers want their agents to move fast, and we want our credentials and production systems kept safe while they do. Nono is the only sandbox that gives us both fine-grained, per-command policies and sophisticated credential management that fits existing, complex real-world toolchains.”
Background on AI agent security
The rise of autonomous AI agents—especially those that can execute code, access files, and interact with APIs—has created new security challenges. These agents are often given broad permissions to perform tasks, but they are vulnerable to prompt injection attacks, where malicious input can cause the agent to execute unintended commands. Without proper sandboxing, a compromised agent can exfiltrate data, modify infrastructure, or launch attacks on internal systems.
Traditional security measures, such as running agents in containers, provide some isolation but do not prevent the agent from accessing any credential or file that is mounted into the container. Network policies can limit egress, but they cannot stop the agent from using credentials it already possesses to authenticate to external services. Nono addresses this gap by enforcing least privilege at the granularity of individual tool calls.
How Landlock and Seatbelt work
Landlock is an unprivileged sandboxing mechanism that allows a process to restrict its own access to files and network resources. It uses a set of rules that define allowed paths and sockets. Once Landlock rules are applied via the landlock_restrict_self system call, the process cannot exceed those restrictions for its lifetime. Nono applies Landlock before the agent process starts, ensuring the agent cannot modify its own sandbox. On macOS, Seatbelt works similarly by loading a sandbox profile that specifies allowed paths and network endpoints.
Both mechanisms operate at the kernel level, meaning they cannot be bypassed by user-space code. This makes them more robust than application-level sandboxes that rely on the agent's own compliance. Combined with Nono's policy engine, this provides a defense-in-depth approach to agent security.
Comparison with other sandboxes
Other open-source sandboxes for AI agents include gVisor, Firecracker, and nsjail. gVisor provides a user-space kernel that intercepts system calls, offering strong isolation but with overhead. Firecracker is a microVM hypervisor that provides hardware-level isolation but requires images and has startup latency. nsjail is a lightweight namespace-based sandbox but does not enforce per-call policies. Nono's advantage is its low overhead and fine-grained control, as it leverages existing kernel security features without needing additional virtualization layers. It is designed specifically for the use case of AI tool calling, where each tool invocation may have different requirements.
Community adoption and contributions
With over 3,100 GitHub stars and 80+ contributors, Nono has seen rapid adoption. Its users include large enterprises in finance, healthcare, and technology, where compliance with regulations like SOC 2 and HIPAA requires strict access controls. The project is open-source under the Apache 2.0 license, and its documentation includes examples for integrating with common agent frameworks like LangChain and AutoGPT. The community has contributed integrations with credential managers and cloud provider SDKs.
Luke Hinds and Stephen Parkinson bring deep expertise in supply chain security and open-source development. Hinds previously led the Sigstore project, which became part of the OpenSSF and is used by millions of developers to sign and verify software artifacts. Parkinson has a background in distributed systems and containers. Their experience informs Nono's design, which emphasizes auditability and minimal complexity.
Ongoing development includes native Windows support, which will allow Nono to protect agents on the most common desktop platform. The team is also exploring integration with eBPF for more fine-grained network filtering and support for Kubernetes pods.
Nono represents a significant step forward in securing AI agents. By moving policy enforcement to the kernel and using phantom credentials, it enables organizations to give agents the access they need without exposing the organization to unnecessary risk. As AI agents become more autonomous and integrated into critical workflows, the importance of such security measures will only grow.
Source: Help Net Security News