Chainguard Workspaces puts every coding agent in its own hardened microVM

The problem: access versus safety

Chainguard, which describes itself as the trusted source for open source, says coding agents now run migrations, remediation campaigns and refactors that last for hours. According to the company, most of these agents have the same access as the developer who launched them, sitting right next to credentials, cloud keys and production systems.

The usual controls, such as permission prompts and allowlists, depend on the agent following the rules, Chainguard says. Many developers also run a dozen agents or more at once. Teams therefore have to choose between giving agents enough access to be useful and accepting the risk, or locking them behind approval prompts and spending their day clicking "allow."

"Right now teams are choosing between letting agents run next to their production keys or babysitting them through approval prompts all day. Neither one scales," said Dan Lorenc, CEO and Co-founder of Chainguard.

How Workspaces works

Workspaces run as remote microVMs that sync each developer's local working tree. Developers keep their editor and git workflow while execution happens off their machine. Because each agent gets its own isolated environment, dozens of agents can work in parallel without colliding, according to Chainguard.

The security features listed by the company are:

• Layers of defense: microVMs are built exclusively with zero-CVE Chainguard OS Packages, including FIPS-compliant toolchains. Dependencies are verified against the lockfile at runtime, so untrusted or tampered code cannot execute.
• Exfiltration-safe by design: real credentials are injected outside the workspace, so agents never hold them. Tools that need a credential on disk get an encrypted, short-lived stand-in that is useless if taken.
• Configurable egress controls: optional network policies block unauthorized outbound requests, so a prompt-injected agent or compromised dependency cannot talk to unapproved external systems.
• Total visibility: every credential call and network connection is logged in a tamper-proof record, and every run generates signed attestations of the environment, code changes and check results.

Speed features for engineering teams

Chainguard also lists several features aimed at faster agent-driven development. Cache-hot microVM snapshots mapped to the exact repository and toolchain let teams launch new workspaces or resume idle ones in seconds. Dependencies load from local disk as defined by the lockfile, which removes external registry fetches and download delays.

Workspaces is paired with Chainguard Checks, which is also launching today in Beta. Agents run CI suites in context and keep iterating until checks pass, which the company says keeps incomplete or faulty code from being handed off.

When an agent needs developer input, the Workspace stays active for 10 minutes before automatically suspending to a snapshot. Memory state, active processes and warm caches are preserved, with no ongoing compute spend while paused.

Early partner and analyst view

Brad McCoy, Senior Manager, Cloud Platforms at Cuscal, said the Australian payments firm needs an environment where AI agents can iterate quickly without risking core systems for agent sandboxing. Cuscal is an early design partner.

Katie Norton, Research Director at IDC, said IDC research shows organizations rank AI-generated code and agentic development workflows alongside third-party software and open source packages as top software supply chain concerns. She said approaches that isolate execution environments, keep secrets out of the agent's reach and maintain auditable records, such as Chainguard's, are designed to support agentic development at scale while preserving control.

What it means for teams

The release shifts the focus from securing the agent itself to securing the place where it runs. Chainguard argues this is becoming a requirement for enterprise teams as agent adoption outpaces security review. Security and platform teams get a way to let agents run autonomously while limiting the damage of any compromise and keeping a signed record of agent activity. Chainguard Workspaces is in Beta, and more information is available at chainguard.dev/workspaces.