---
title: Chainguard releases beta tools for secure AI agent coding
url: https://www.elseif.net/chainguard-releases-beta-tools-for-secure-ai-agent-coding
published: 2026-11-01T20:03:49+00:00
language: en
section: Harnesses
source: https://www.infoq.cn/article/UNli8x0wc8XUNjI5ETya?utm_source=rss&utm_medium=article
organizations: Chainguard, E2B, StepSecurity, Sonatype, JFrog, Amazon
publisher: elseif
---

# Chainguard releases beta tools for secure AI agent coding

Chainguard has released two beta products designed to run and test code written by developers and AI agents. The company announced Chainguard Workspaces and Chainguard Checks at the Assemble conference in London. These tools provide a secure environment for executing code and integrating continuous testing into the development workflow.

The products address the security risks associated with AI agents that require permissions to install packages, execute shell commands, and edit configuration files. Running these operations on local developer machines exposes enterprise credentials and local services to generated or third-party code. Conversely, submitting every change to traditional continuous integration services can cause queue congestion and repeated downloads of identical dependencies.

Chainguard Workspaces assigns a dedicated remote micro virtual machine to each developer or agent. The chainctl develop command synchronizes the local working directory, including uncommitted changes, to this environment. When a user disconnects, the system generates a session snapshot that can restore files, processes, and shell context upon resumption. Teams can create multiple isolated workspaces for the same codebase, allowing agents to test different solutions without interfering with ports, caches, or process states.

A host-side agent adds short-lived credentials to approved outbound requests, avoiding the placement of long-term keys inside the virtual machine. Optional outbound rules can intercept and log connections to unauthorized endpoints. The system records commands, code changes, and network calls, with logs claimed to be tamper-proof. This design aims to reduce the damage caused by compromised dependencies or prompt injection attacks that might cause agents to malfunction.

Chainguard Checks runs continuous integration steps in pre-warmed micro virtual machines built from Chainguard packages. Dependencies are prepared in advance based on project lock files, and the snapshot pool is rebuilt when these files change. Developers can invoke these checks via command line, pre-commit hooks, or a GitHub application. AI agents can access the same checks through an MCP server or SDK. The goal is to allow developers and agents to test, report errors, and fix code without waiting for slow continuous integration processes.

When used together, the Workspace suspends during test runs. Failed checks return structured logs to the restored session, allowing agents to try different changes without rebuilding the environment. Successful runs create a proof linked to the environment, results, and commit. Proposed merge gates can verify this evidence without re-running the test suite. Each run produces a signed proof binding the environment, verdict, and commit SHA, enabling merge gates to validate passing results without re-execution.

This design relies on the assumption that verified input content remains unchanged and that the codebase trusts Chainguard's execution and signing systems. The announcement did not include performance comparisons between Checks and mainstream continuous integration services, nor did it explain how customers can verify the claimed tamper-proof nature of the logs. Workspaces currently supports Claude, with plans to support other agents later. Products are billed based on actual compute consumption, and both offer a 30-day trial.

Chainguard also announced two other build pipeline related items. Chainguard Actions is now generally available, containing over 1000 rebuilt and continuously maintained GitHub Actions. Chainguard Libraries for Go and .NET entered early preview. The Libraries service scans dependencies for malware and grayware, allows configurable delays before new packages go live, and ports fix patches for selected vulnerabilities. The beta scanner has made determinations on over 5000 Go and .NET packages, with more than 10 percent of detection samples having no match in public data sources.

The market already has established competitors. E2B runs agent sessions in Firecracker micro virtual machines, controls outbound traffic, and resolves credentials outside the virtual machine. StepSecurity Harden-Runner monitors network, file, and process activity on GitHub Actions runners and can enforce outbound network policies. Sonatype Repository Firewall intercepts or quarantines packages with malicious behavior or vulnerabilities before the build. JFrog Curation enforces security, license, and package age policies during the download phase. Chainguard's approach integrates these capabilities with signed test results, refactored Actions, and fixed dependencies.

Using micro virtual machines for untrusted build tasks and agent workloads is a mature practice. InfoQ's AI accelerated development security guide recommends isolated micro virtual machines or strictly restricted containers for agent-generated code, combined with short-lived credentials and default deny network policies. Amazon Bedrock AgentCore provides isolated CPU, memory, and file system resources for each user session. Vercel's Hive build system uses Firecracker micro virtual machines and short-lived WireGuard tunnels. Chainguard's unique contribution is integrating this isolation with its own package catalog, continuous integration proofs, and agent execution paths.