An agent in your terminal can do anything you can. It can delete files outside the project, read your SSH keys, or follow instructions someone planted in a dependency's README. Approval prompts are supposed to catch that, but by the fortieth prompt most people click yes without reading — and the prompt only shows the command the agent typed, not what the build script went on to do. These ten launches attack that from several directions at once.
Move the agent somewhere harmless
Capsem is a Rust hypervisor that sandboxes AI agents in air-gapped Linux VMs on your Mac. It installs by download or a shell command, and works with Claude Code, Codex and Cursor through a setup prompt your own agent follows, which keeps existing environments and security settings intact. Air-gapped is the operative word: the sandbox is not merely a separate folder, it is a separate machine with no route out.
Work on a copy, then choose what lands
Airlock runs Claude Code or Codex in a virtual machine on your Mac, working on a copy of your project. Your real folder is never shared with the agent and it cannot reach anything else on the machine. When it is finished you get every changed file as a diff and tick the ones you want, and build scripts, git hooks, CI config and the agent's own settings are flagged — because those run on your Mac later, and that is how an agent's code would get out.
Coordinate while the edits are happening
Weft takes a different approach: rather than isolating each agent, it sequences them. Agents submit tool-call edits to a per-repository sequencer, which validates each edit against accepted changes since the agent's base and returns actionable diagnostics through the agent's native hooks. Humans see the same event stream and can approve, pause, message, undo or inspect evidence. There are no file locks and no waiting for a human merge.
Give the agent a desktop of its own
Braus gives agents a desktop workspace on your Mac, so they work in your apps while you keep using your Mac. You hand a worker a task in the Braus app, or connect Claude Code or Codex through MCP to work in desktop apps, even when those apps expose neither an API nor an accessibility tree. Isolation here is about the workspace, not the filesystem.
Computer use that stays out of your way
OpenComputerUse is computer use for agents that runs in the background as an MCP server. You start a session with an app and get a session id back, drive the app with that id, then end the session. The app works behind your other windows, and your pointer, keyboard focus and frontmost app stay where they are. Sessions end when the server exits, which makes the blast radius easy to reason about.
A control plane you host yourself
TaskHandoff is a self-hosted control plane for running, managing and collaborating with AI workspaces across local and remote machines, positioned as an open-source alternative to Codex Desktop's cross-device control. It runs Codex and OpenCode in one workbench for development, workspace management and code review, and ships an agent skill that teaches your agent to drive it. Self-hosting means the audit trail stays on your infrastructure.
Parallel agents with a human in the loop
Frink is a desktop-first, open-source application for running parallel agents and multi-step workflows triggered by schedules, webhooks or events from tools like Linear and Sentry. Workflows can mix steps you write yourself in code with agent, command and approval steps. The approval step is the containment mechanism here: automation that stops and asks, on your machine, with no account needed.
Watching them from your phone
Droidtty addresses the other half of the problem — that unattended agents are unattended. It puts your coding agents on your phone, showing what they are doing and notifying you only when something needs you, with a real terminal available when it has to be. Agents spend minutes reading, editing and testing, and almost none of it needs a human, so filtering the notifications is the whole design.
Teams of agents with protected gates
Bees is an open-source autonomous multi-agent platform that runs on your own computer. It coordinates agentic teams with loop engineering, independent reviewer loops and protected human gates, and files and execution stay private on your machines while organizational memory synchronizes centrally. Independent reviewers are the interesting part: one agent checking another is cheaper than you checking all of them.
The same logic, pointed at attackers
Argus applies the pattern to security operations. It is an open-source platform where AI agents do the legwork and you stay in control, watching cloud, identity, code, endpoints, network and Kubernetes, investigating with agents and containing in seconds. Every action is typed, checked against policy, dry-run first and reversible — the same containment vocabulary, aimed at incidents rather than commits.
The pattern underneath
Three mechanisms keep showing up: move execution somewhere it cannot reach you, make every change reversible and reviewable, and put a human gate where the cost of being wrong is high. Which one you reach for depends on whether you are worried about accidents, about concurrent edits, or about an agent that has been told to do something you did not ask for.