Hardware-isolated, credential-free microVMs built from zero-CVE Chainguard OS Packages give security and platform teams a safe way to run fleets of agents at full speed

SEATTLE, Oct. 14, 2026 /PRNewswire/ — Chainguard, the trusted source for open source, today announced Chainguard Workspaces, hardened microVMs that give every developer and coding agent their own secure environment, with no access to sensitive credentials and optional egress policies that block any connection a team has not approved. Because protection is built into the environment rather than left to the agent, security and platform teams can let agents run autonomously while limiting the blast radius of any compromise and keeping a signed record of everything each agent did.

The tradeoff between access and safety

Coding agents today run migrations, remediation campaigns, and refactors that last for hours, and most agents have the same access as the developer who launched them, right next to their credentials, cloud keys, and production systems. The controls meant to keep them in check, such as permission prompts and allowlists, depend on the agent’s adherence to the rules. At the same time, many developers now run a dozen agents or more at once. Teams have to choose between giving agents enough access to be useful and accepting the risk, or locking them down behind approval prompts and spending their day clicking “allow.”

“Right now teams are choosing between letting agents run next to their production keys or babysitting them through approval prompts all day. Neither one scales,” said Dan Lorenc, CEO and Co-founder, Chainguard. “Workspaces gets rid of that tradeoff. Every agent gets its own hardened, isolated machine with nothing in it worth stealing, so you can let it run for hours and trust what comes out the other end.”

A separate, hardened environment for every agent

Chainguard Workspaces is built for security and platform teams whose developers run fleets of coding agents. Workspaces run as remote microVMs that sync each developer’s local working tree, so developers keep their editor and git workflow while execution happens off their machine. Because every agent gets its own isolated environment, dozens of agents can work in parallel without colliding, and long-running migrations, remediation campaigns, and refactors can run for hours with no one watching. Teams can safely run agent-generated or third-party code, give every developer a standardized environment drawn from their Chainguard catalog, and try many candidate fixes at once. Security teams get visibility into what the agent read, ran, and reached before approving agent use.

To meet security teams’ needs, Workspaces has:

• Layers of defense: Workspace microVMs are built exclusively with zero-CVE Chainguard OS Packages, including FIPS-compliant toolchains. Dependencies are verified against the lockfile at runtime, so untrusted or tampered code can’t execute.
• Exfiltration-safe by design: Real credentials are injected outside the workspace, so agents never hold them. Tools that need a credential on disk get an encrypted, short-lived stand-in that is useless if taken.
• Configurable egress controls: Optional network egress policies block unauthorized outbound requests, preventing a prompt-injected agent or compromised dependency from communicating with unapproved external systems.
• Total visibility into every run: Every credential call and network connection is logged in a tamper-proof record, and every run generates signed attestations of the exact environment, code changes, and check results.

Alongside those security controls, Chainguard Workspaces provides engineering teams with what they need to build faster with agents:

• Fast starts and resumes: Cache-hot microVM snapshots mapped to the exact repository and toolchain let teams launch new workspaces or resume idle ones in seconds.
• Instant local package loading: Dependencies load directly from local disk as defined by the lockfile, removing external registry fetches and download delays from the loop.
• Built-in completion validation with Chainguard Checks: Paired with Chainguard Checks (also launching today in Beta), agents run CI suites in context and keep iterating until checks pass. Tying the loop exit to verified results keeps incomplete or faulty code from being handed off.
• Human-in-the-loop: When an agent requires developer input, the Workspace stays active for 10 minutes before automatically suspending to a snapshot. Memory state, active processes, and warm caches are preserved with no ongoing compute spend while paused.

With Workspaces, Chainguard extends the secure-by-default foundation behind its open source software catalog to the environments where agents write and run code. As agent adoption outpaces security review, the shift from securing the agent to securing where it runs is becoming a requirement for enterprise teams.

“Banks, fintechs, and corporates across Australia rely on Cuscal to move money safely. For agent sandboxing, we need an environment where AI agents can iterate quickly without risking core systems. We’re excited to work hand-in-hand with Chainguard as an early design partner to shape the future of software development end-to-end,” Brad McCoy, Senior Manager, Cloud Platforms, Cuscal.

“IDC research shows that organizations rank AI-generated code and agentic development workflows alongside third-party software and open source packages as top software supply chain concerns. Addressing that risk means accounting for what an agent can access while it works, in addition to the code it writes. Agents running with developer-level credentials and broad network access extend the supply chain attack surface in ways that many traditional controls were not designed to address,” said Katie Norton, Research Director at IDC. “Approaches that isolate agent execution environments, keep secrets out of the agent’s reach, and maintain auditable records of agent activity, such as the approach Chainguard is taking with Chainguard Workspaces, are designed to support agentic development at scale while preserving control over the development environment.”

Chainguard Workspaces is available now in Beta. For more information, visit: chainguard.dev/workspaces.

About Chainguard
Chainguard is the trusted source for open source. By providing engineers and AI agents with hardened, trusted, and production-ready artifacts, Chainguard helps organizations prevent AI supply chain attacks, increase engineering velocity while reducing toil, and maintain continuous compliance. Customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, DocuSign, OpenAI, Public Storage, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital.  For more information, visit: https://www.chainguard.dev/ 

Media Contact: Brittany Hendrickson, press@chainguard.dev

View original content to download multimedia:https://www.prnewswire.com/news-releases/introducing-chainguard-workspaces-hardened-hardware-isolated-environments-for-faster-agentic-development-302907716.html

SOURCE Chainguard