An AI coding agent opens a terminal, reads a config file, and finds a live cloud key sitting in plaintext. It runs with the permissions of the person who launched it. Every file that person can read, the agent reads. Every credential in the environment, the agent can use. That reach is where the damage starts. A prompt injection, a mistyped command, or a hallucinated path points that access at the company's own credentials and production systems.

Kernel-Level Enforcement

Luke Hinds built Sigstore at Red Hat, a signing project that became a standard for verifying where software packages come from. His company, nolabs, which he co-founded with Stephen Parkinson, released Nono, an open-source runtime that confines AI agents at the operating system kernel. Nono has drawn more than 3,100 stars on GitHub. Over 80 people have contributed to it, and its users include large enterprises and teams in regulated industries.

Nono checks every action an agent takes against policies written in code. An agent asks to use a tool, open a file, or reach a network endpoint. The kernel returns the verdict. Enforcement sits in the operating system, below the agent and below any guardrail sharing its process. Nono leans on Landlock on Linux and Seatbelt on macOS, kernel features that strip a process of privileges and hold them stripped. Once the sandbox applies, the limits stand for the life of the process.

Background and Career of Luke Hinds

Luke Hinds has a long track record in open-source security. Before founding nolabs, he was a principal engineer at Red Hat where he created Sigstore, a project that now secures millions of software artifacts. Sigstore's adoption by major package ecosystems like npm, PyPI, and RubyGems gave Hinds a deep understanding of how trust boundaries break at scale. He saw that AI agents present a similar but more dynamic problem: they inherit all the privileges of their operator and can be manipulated in real time. Nono was born from this insight.

His co-founder, Stephen Parkinson, previously led security engineering at a major cloud provider and brought experience in building policy engines for containerized workloads. Together they formed nolabs in late 2024 with the mission to give developers the speed of AI agents without the security risk. The company is funded by a seed round from prominent cybersecurity investors.

Technical Deep Dive: Landlock and Seatbelt

Landlock is a Linux security module that restricts access to filesystems and networking for a process, even if that process runs with root privileges. It is part of the mainline Linux kernel since version 5.13. Nono uses Landlock to define a whitelist of files, directories, and network endpoints that an agent can access. Any action outside this list is denied by the kernel before the agent code executes. Seatbelt on macOS works similarly, using the macOS Sandbox API to confine processes to a container with fine-grained rules. Nono integrates with both at the system call level, meaning that even if an agent tries to bypass its own safety layers, the kernel enforces the policy.

Windows support is handled through the Windows Subsystem for Linux (WSL2), which runs a real Linux kernel so Nono's Landlock enforcement applies exactly as it does on native Linux. Hinds told Help Net Security: "Native Windows enforcement is under active research." This cross-platform approach allows teams operating heterogeneous environments to adopt a single sandboxing solution.

Agent Tool Sandboxing: Scoped Authority Per Call

The biggest gap in existing agent security is broad, session-long permissions. An agent gets access to a vault of credentials at launch and can use them for any task until the session ends. Nono's newer feature, Agent Tool Sandboxing, hands each tool call its own scoped authority. A tool receives a phantom credential standing in for a real secret. Its file access covers only what the task needs. Its network reach ends at the endpoints it must hit. The authority expires when the call finishes.

Hinds described how the authentication works: "Nono routes the request through a trusted proxy outside the sandbox, which retrieves the real credential from secure storage – such as the operating system's keychain, 1Password, Bitwarden, or Kubernetes Secrets – and injects it only into the request sent to the approved external API." This proxy is itself sandboxed and run with minimal privileges. The agent never sees the actual credential, even in memory. If an attacker compromises the agent mid-call, they only obtain a phantom token that is valid for that single operation.

Real-World Adoption at Datadog

James Carnegie, a staff security engineer at Datadog, is one of Nono's users: "Datadog engineers want their agents to move fast, and we want our credentials and production systems kept safe while they do. Nono is the only sandbox that gives us both fine-grained, per-command policies and sophisticated credential management that fits existing, complex real-world toolchains." Datadog uses Nono to secure internal agents that automate incident response and infrastructure changes. The company's monitoring platform already tracks millions of endpoints, and their security team requires that every agent action be logged and bounded by policy.

Comparison to Other Approaches

Containers and microVMs shrink the blast radius, but an over-permissioned agent inside one still holds every key it was handed. Some teams use proxy-based interception or LLM-level guardrails, but those run in the same process as the agent and can be bypassed by a clever injection. Nono's kernel-level enforcement cannot be bypassed from user space, making it the most robust option available.

Other open-source solutions like gVisor or Firecracker provide stronger isolation but at a higher performance cost and complexity overhead. Nono is designed to be lightweight: there is no guest kernel, no virtual machine boot time, and no additional orchestration. It works with any agent framework that executes shell commands or API calls, including LangChain, AutoGPT, and custom scripts.

Use Cases and Limitations

Nono is particularly useful for teams that deploy agents in CI/CD pipelines, code review bots, or automated security testing. In regulated industries such as finance and healthcare, where auditors require proof that no sensitive data leaked to an AI, Nono provides an audit trail of every permitted and denied action. The policy files are declarative and can be checked into version control, making the sandbox configuration as auditable as any code change.

One limitation is that Nono currently cannot protect against side-channel attacks where the agent infers secrets from timing or file existence. It also does not prevent an agent from exfiltrating data over an allowed network endpoint if the agent uses the granted credentials for a different purpose. However, the phantomed credential scheme dramatically reduces this risk because the agent never holds the real secret.

Another area of active development is dynamic policy adjustment. Today, policies are static and defined before the agent session. Some users have requested the ability to grant temporary elevations based on user approval, similar to sudo. Hinds indicated that this is on the roadmap but the priority remains making the static enforcement bulletproof before adding dynamic features.

Nono is available for free on GitHub under the Apache 2.0 license. The project welcomes contributions, especially for native Windows enforcement and support for more secret stores. With over 3,100 stars and 80+ contributors, it has already become a key tool for organizations serious about securing their AI agent workflows.

Source:Help Net Security News