Nono: Open-Source Sandbox Mitigates AI Agent Risks
Nono, a new open-source runtime, secures AI coding agents by confining them at the OS kernel level, preventing unauthorized access to sensitive data and credentials.
The increasing reliance on AI coding agents, while boosting developer productivity, introduces significant security risks. These agents, often running with the same permissions as their human operators, can inadvertently expose sensitive data, credentials, and production systems if not properly contained. A compromised agent, whether through prompt injection, a mistyped command, or a misconfiguration, could lead to widespread damage by accessing critical company resources.
To address this growing threat, Luke Hinds, co-founder of nolabs, has released Nono, an open-source runtime designed to sandbox AI agents at the operating system kernel level. Hinds, who previously built Sigstore at Red Hat, aims to provide a secure environment that prevents agents from accessing unintended files or cloud keys, thereby reducing the potential for exploitation.
Nono's architecture places enforcement at the operating system kernel, below the agent and any guardrail processes. It leverages kernel features like Landlock on Linux and Seatbelt on macOS to strip processes of privileges, with these limitations remaining in effect for the entire life of the process. For Windows users, Nono currently supports enforcement through the Windows Subsystem for Linux (WSL2), which runs a native Linux kernel.
A key innovation in Nono is its Agent Tool Sandboxing feature. This addresses the problem of broad, session-long permissions by scoping authority to individual tool calls made by an agent. Each tool receives a "phantom credential" that stands in for a real secret, with file access and network reach limited to what the specific task requires. This scoped authority expires once the tool call is completed.
When a tool needs to interact with a live service, Nono routes the request through a trusted proxy outside the sandbox. This proxy retrieves the actual credential from secure storage—such as a keychain, password manager, or Kubernetes Secrets—and injects it only into the request sent to the approved external API. This ensures that the agent itself never directly handles sensitive credentials.
Early adopters have praised Nono's ability to balance speed and security. James Carnegie, a staff security engineer at Datadog, noted that Nono is the only sandbox offering both fine-grained, per-command policies and sophisticated credential management that integrates with complex, real-world toolchains. This allows Datadog engineers to leverage AI agents for faster development while maintaining robust security for their credentials and production systems.
Nono has already garnered significant attention within the developer community, achieving over 3,100 stars on GitHub with contributions from more than 80 individuals. Its adoption by large enterprises and teams in regulated industries underscores the perceived need for such security solutions in the rapidly evolving AI landscape.
Nono is available for free on GitHub, offering a powerful, open-source solution for organizations looking to safely integrate AI agents into their workflows without compromising sensitive data or systems.