Stop Letting AI Agents Run Commands Blindly: Meet Zero-Trust Sandbox Auditor

AI coding agents, such as Claude Code or GitHub Copilot Workspace, are being experimented with by many developers. These agents are granted terminal access to repositories and can execute tasks like installing dependencies. However, this can pose serious security risks. An adversary-controlled agent could run malicious scripts, access sensitive files, or even establish a reverse shell on the host system.

Developers often assume that running the agent inside a Docker container provides sufficient security, but this is not guaranteed.

To address these concerns, I developed Zero-Trust Sandbox Auditor (ztsa). The core philosophy of ztsa is to never convert uncertainty into permission before running untrusted code or letting autonomous agents install third-party packages. The tool performs a deterministic preflight gate that checks whether the execution environment and dependency manifest meet the required isolation and integrity indicators for a given trust level. If any checks fail, the command is never started, resulting in an exit code of 3.

ztsa operates by sitting between the autonomous agent and the operating system, probing the environment and analyzing dependencies. It checks various aspects, including:

1. Environment integrity: Ensures the process is not running as root, isolation is confirmed, seccomp filter is enabled, NoNewPrivs flag is present, dangerous Linux capabilities are absent, and malicious code-injection environment variables are not set.

2. Filesystem and credential leakage: Detects mounted container daemon sockets, exposed host credential paths, writable sensitive system directories, project .npmrc files exposing authentication tokens, and leaked secret-like environment variables.

3. Network exposure: Identifies active TCP listeners bound to 0.0.0.0 or ::, and configuration of DOCKER_HOST pointing outside the local sandbox.

4. Supply-chain and dependency build hooks: Checks for missing integrity lockfiles, untrusted lifecycle scripts, piped shell installers, unpinned Git commits, and unauthorized directory traversal APIs in Cargo build.rs files.

ztsa provides three dynamic trust profiles: repo (for your own trusted repository), dependency (for preflight checks before running npm install or cargo build), and untrusted (for autonomous AI agents running code from pull requests or public repos). The tool enforces 38 discrete, auditable rules grouped into four primary categories and does not require any runtime dependencies. Instead, it is built with pure native Node.js standard library functions.