Coop isolates Claude Code and Codex agents in disposable VMs

What happened

Trail of Bits released Coop, a Rust command-line tool that runs Claude Code and Codex inside disposable virtual machines instead of directly on a developer's laptop. Each VM gets its own filesystem, network stack and Docker daemon, and the agent inside it never touches the host. The project appeared on GitHub and reached the Hacker News front page with 56 points and 12 comments.

Coop is a VM manager for AI coding agents: it boots a disposable Firecracker microVM on Linux or a Lima VM on macOS, gives Claude Code or Codex full tool access inside that VM (Docker, git, compilers, package managers), and treats the VM itself, not the process, as the security boundary. When the session ends, the VM is destroyed.

What changed

• Two backends, one CLI. On Linux, Coop boots Firecracker microVMs on KVM. On macOS, it uses Lima on top of Apple's Virtualization.framework. Backend choice is resolved at compile time, not at runtime, so the same command set works on either platform.
• The guest is deliberately wide open. Inside the VM, the guest user has passwordless sudo (NOPASSWD:ALL), and Claude Code runs with defaultMode: bypassPermissions in a managed settings.json. The claude/codex launchers pass --dangerously-bypass-approvals-and-sandbox or --dangerously-skip-permissions unless the user adds --ask. Trail of Bits' own trust-model document calls this correct by design: