Defender Impact
Agentic AI coding assistants granted full tool access — Docker, git, package managers, compilers — on developer workstations represent an uncontrolled execution surface. Coop directly closes this gap by wrapping that execution inside disposable, isolated virtual machines, giving security teams a repeatable containment boundary that didn’t previously exist as a packaged, AI-specific control.
Capability Overview
Coop is an open-source Rust CLI published by Trail of Bits that provisions and manages lightweight, throwaway virtual machines specifically designed for running Claude Code (Anthropic) and Codex (OpenAI). Within each VM, the AI agent has unrestricted access to the full development toolchain — Docker, git, compilers, package managers — which is precisely the access these agents require to be useful. The key architectural insight is that this access is granted inside an isolated, reproducible environment rather than directly against the host machine or shared infrastructure.
Each VM is cheap to create and destroy, making ephemeral-by-default a practical operational model rather than a theoretical aspiration. The project is implemented in Rust, includes a proxy component (coop-proxy), fuzzing infrastructure, and a structured release process — markers of engineering maturity that matter when security teams are assessing whether to trust a containment tool.
The tool targets a specific and well-understood pain point: AI coding agents in their current form require broad system permissions to function effectively, and the ecosystem has not yet standardised on how to scope or contain those permissions. Coop is the first purpose-built, open-source answer to that question for the two most widely deployed agentic coding assistants.
Defensive Advances
Host isolation by default. Security teams can now mandate that all Claude Code and Codex sessions run inside a Coop VM, eliminating the class of risks where an AI agent — whether through misinstruction, prompt injection, or tool misuse — modifies, exfiltrates from, or executes against the host system.
Reproducible security posture. Because VMs are disposable and templated, every session starts from a known-good baseline. This removes the drift problem common in long-lived developer environments where accumulated state creates unaudited attack surface.
Reduced privilege pressure. Developers and platform teams previously faced a binary choice: grant AI agents host-level access or accept severely degraded functionality. Coop dissolves that tradeoff by making full tool access safe inside a disposable boundary.
Auditable open-source implementation. Security teams can inspect, fork, and extend the containment logic. The presence of fuzzing infrastructure and a SECURITY.md signals that Trail of Bits has applied its own security engineering discipline to the project.
Residual Gaps
Provider coverage is limited. Coop currently supports Claude Code and Codex. Organisations running GitHub Copilot Workspace, Cursor, or other agentic coding environments will need to wait for community extensions or build their own integration layer.
Enterprise policy enforcement is immature. There is no built-in mechanism for centralised policy management — for example, restricting which tools are available within the VM, enforcing network egress rules per team, or integrating with existing privileged access management systems. These are expected maturity gaps for an early open-source release but represent real work before regulated-environment deployment.
Audit logging is developer-grade, not SOC-grade. VM lifecycle events and agent actions within the VM are not yet surfaced in a format suitable for ingestion into a SIEM or EDR. Security operations teams will need to build that bridge themselves.
VM escape is a residual concern. Isolation quality depends on the underlying hypervisor and host configuration. Teams should assess their hypervisor stack and apply standard VM hardening before treating Coop boundaries as equivalent to production isolation controls.
Framework Mapping
Coop most directly mitigates LLM08 (Excessive Agency) by placing a hard boundary around what AI agents can affect, and LLM07 (Insecure Plugin Design) by containing tool execution. From the ATLAS perspective, it reduces the practical impact of AML.T0086 (Exfiltration via AI Agent Tool Invocation) and AML.T0083 (Credentials from AI Agent Configuration) by ensuring that any successful exploitation is contained within a disposable VM rather than the host.
Deployment Considerations
Organisations should treat Coop adoption as a two-phase exercise. In phase one, use it as a developer-opt-in tool to gather operational experience with VM lifecycle, performance impact, and toolchain compatibility. In phase two, work with platform engineering to make Coop-wrapped execution the mandatory path for agentic AI coding sessions, integrating VM creation events into existing audit pipelines.
Prerequisite decisions include: which hypervisor stack is approved, what the network egress policy inside VMs should be, and whether VM images will be centrally maintained or developer-managed.
Defender Checklist
- Review the Coop repository and SECURITY.md before approving for any environment handling sensitive code
- Test VM lifecycle performance against representative developer workflows to validate operational viability
- Define a VM base image hardening standard (egress rules, filesystem mounts, credential access)
- Identify a SIEM integration path for VM creation, session, and destruction events
- Establish a policy decision: developer-optional vs. mandatory enforcement for AI coding agent sessions
- Monitor the Coop issue tracker for provider expansion and enterprise feature development