Why You Shouldn't Let AI Agents Run Naked Bash: Building an Unprivileged Sandbox in Rust

AI coding agents are becoming an important part of modern software development.

Tools like Claude Code, OpenAI Codex, Aider, OpenHands, Cursor, and other autonomous coding agents can execute terminal commands, modify source files, install dependencies, and run scripts.

What happens when an AI agent executes a dangerous command on your actual development machine?

A simple confirmation prompt isn't always enough.

I started building ShadowCLI to explore a different approach: putting a zero-trust security boundary between AI coding agents and the developer's machine.

GitHub: https://github.com/6t9xstar/shadowcli

ShadowCLI is an open-source, Rust-based execution sandbox for AI coding agents.

Instead of allowing commands to modify your actual project immediately, ShadowCLI executes them inside an isolated Linux environment.

Changes are captured in a temporary copy-on-write layer. Developers can inspect the resulting differences, review modifications, approve changes, or discard the session.

Let AI agents work, but keep developers in control of what reaches their actual projects.

ShadowCLI uses multiple Linux security mechanisms to isolate command execution.

These layers work together to create a defense-in-depth execution environment.

ShadowCLI is designed for Linux systems with the required kernel and sandbox capabilities.

git clone https://github.com/6t9xstar/shadowcli.git cd shadowcli Enter fullscreen mode Exit fullscreen mode 2. Build the project You need Rust 1.80 or later.

cargo build --release Enter fullscreen mode Exit fullscreen mode 3. Install the binary sudo cp target/release/shadow /usr/local/bin/ Enter fullscreen mode Exit fullscreen mode 4. Check system compatibility shadow doctor Enter fullscreen mode Exit fullscreen mode This checks important system capabilities, including kernel compatibility, user namespaces, Landlock, Seccomp, and filesystem support.

shadow run -- npm test Enter fullscreen mode Exit fullscreen mode By default, outbound network access is blocked.

If a task requires network access, you can explicitly allow it:

shadow run --allow-network -- cargo build Enter fullscreen mode Exit fullscreen mode You can also configure execution timeouts:

shadow run --timeout 30 --./agent-script.sh Enter fullscreen mode Exit fullscreen mode Inspect Changes Before Applying Them One of the most important parts of ShadowCLI is its review workflow.

After an agent executes commands, inspect the captured changes:

shadow diff Enter fullscreen mode Exit fullscreen mode View a summary:

shadow diff --stat Enter fullscreen mode Exit fullscreen mode Review modifications interactively:

shadow review Enter fullscreen mode Exit fullscreen mode Apply approved changes:

shadow apply --all --yes Enter fullscreen mode Exit fullscreen mode If you need to undo the most recent apply operation:

shadow apply --rollback Enter fullscreen mode Exit fullscreen mode Or discard unapplied sandbox changes:

shadow discard Enter fullscreen mode Exit fullscreen mode This creates a workflow where executing commands and accepting their modifications are separate decisions.

ShadowCLI is designed as a general execution boundary for tools that execute terminal commands.

For example, you can wrap a terminal-based agent command:

shadow run -- aider Enter fullscreen mode Exit fullscreen mode You can also integrate sandboxed command execution into your own Python-based agent:

import subprocess result = subprocess. run ( [ " shadow ", " run ", " --project ", ". ", " --allow-network ", " -- ", " npm ", " test " ], capture_output = True, text = True ) print ( result. stdout ) print ( result. stderr ) Enter fullscreen mode Exit fullscreen mode Actual compatibility depends on how an agent interacts with the filesystem and launches subprocesses.

I believe AI-assisted development needs more than a simple permission dialog.

A secure execution workflow should consider:

ShadowCLI brings these ideas together using native Linux security technologies and Rust.

It is not a replacement for security auditing, backups, or a hardened virtual machine. Its protection also depends on the host kernel, filesystem, configuration, and the correctness of its isolation mechanisms.

ShadowCLI is released under the Apache-2.0 license.

I'm continuing development and would appreciate feedback from developers working with:

If you're interested in this area, explore the repository, review the implementation, report issues, or contribute improvements.

GitHub Repository: https://github.com/6t9xstar/shadowcli

I'd particularly like to hear your thoughts:

Would you trust an AI coding agent with unrestricted access to your development machine, or would you prefer every modification to go through an isolated execution and review process?

Expand G G G Follow Building LiveSuggest, a meeting assistant that stays on your screen. No bot joins the call. Joined Mar 24, 2026 • Nov 4 Dropdown menu Copy link Hide Clone and cargo build are not enough on Debian or Ubuntu. Unprivileged user namespaces stay off by default there, a sysctl on Debian and an AppArmor switch on Ubuntu 24.04, so the namespace stack in the post never starts. shadow doctor is the check that shows it.