Hazmat runs coding agents under a separate macOS user

Hazmat gives each coding agent its own macOS user account, a kernel-enforced sandbox, a firewall, and a DNS blocklist, per Help Net Security's August 17 coverage. Before a session starts, it prints exactly which paths the agent can write to, which it can only read, and what network access it gets. It also takes an automatic backup before each session.

The problem it targets is the one most people using coding agents skip past. Launch an agent the normal way and it runs as you, with your account's full reach. Every SSH key and cloud credential sitting in your home directory is fair game if the agent goes wrong or gets prompted into doing something it shouldn't.

The repo, dredozubov/hazmat, was created March 27 and sits at 128 stars as of the August 17 coverage. That's early. Small user base, not much of a track record yet. What stands out is the TLA+ verification, a formal method usually reserved for systems where a bug can't be patched later, not a side project a few hundred people have starred.

I don't run agents under a separate OS user. I trust the sandboxing my tools already do and I've never had one touch something it shouldn't. But I also haven't audited what my home directory actually exposes if one did. Hazmat's real contribution isn't the tool, it's naming the exposure out loud: if you're running coding agents locally, you already know what's in reach. The question is whether you've looked.