A Security Firm Built a Throwaway Machine for Your Coding Agent to Wreck
Trail of Bits released Coop, a command line tool that spins up disposable virtual machines where Claude Code and Codex get full tool access without touching your own computer. It uses Firecracker on Linux and Lima on macOS.
The security consultancy Trail of Bits has released Coop, and it answers a question a lot of people have quietly been avoiding: what happens if the coding agent you gave full permissions to does something you did not want. Coop is a small command line tool that creates disposable virtual machines where agents like Claude Code and OpenAI’s Codex get complete access to Docker, git, compilers and package managers, with none of it touching your actual computer. Each machine is isolated, reproducible, and cheap enough to throw away and make again.
The mechanics are unglamorous and that is the point. On Linux, setup installs Firecracker, the lightweight virtual machine technology Amazon built for its serverless platform, and fetches a guest kernel. On macOS you need Lima installed first, via Homebrew, or setup fails. Trail of Bits has been building this category for a while: it also maintains a devcontainer for running Claude Code with permission prompts turned off inside a container that can only reach your project directory, and a tool for spinning up throwaway cloud servers for the same purpose. All three exist because the firm reviews untrusted code for a living and wanted the agent nowhere near the auditor’s laptop.
Why the “yes to everything” button is the whole problem. Coding agents ask permission before running commands, and after the twentieth prompt everybody turns that off, because the tool is only fast if you stop supervising it. The trouble is that the same setting that stops the interruptions also removes the last check on a system that will happily run a command it misread, or one that arrived hidden inside a file it was asked to read. That second case has a name, prompt injection, and it is the reason isolation beats caution: you cannot reliably read every instruction your agent encounters, but you can make sure the machine it is standing on does not matter. Sandboxing is not a statement about how much you trust the model. It is what you do so that trust stops being load-bearing.
What this means for you. If you use a coding agent in permissive mode on your main machine, this is the week to change that, and Coop is one of several reasonable ways to do it. Anthropic ships sandbox options in Claude Code’s own documentation, devcontainers work in VS Code, and a cheap cloud instance you destroy afterwards works too. Pick whichever fits your setup rather than the one with the best readme. If you do not write code, the transferable idea still holds: when you give an AI tool the ability to act rather than just answer, the question worth asking is not “will it behave” but “what can it reach if it does not”.
Sources
Anthropic's Fable 5.1 Costs the Same, Except for the Part Agents Use Most
Claude Fable 5.1 launched on 1 September with unchanged headline pricing at $10 and $50 per million tokens, but cache reads dropped 75 percent to $0.25. Anthropic says that saves about 25 percent on typical work.
