Seattle – October 14, 2026 -- Chainguard has launched Chainguard Workspaces in Beta, giving every developer and coding agent its own hardened microVM with no access to sensitive credentials and optional egress policies that block any connection a team has not approved.
Chainguard moves agent protection from the agent to its environment
The company argues that most coding agents today hold the same access as the developer who launched them, sitting next to credentials, cloud keys and production systems. Controls such as permission prompts and allowlists depend on the agent following the rules. Many developers now run a dozen agents or more at once, forcing teams to choose between granting broad access and approving prompts all day.
Chainguard CEO and Co-founder Dan Lorenc said teams are choosing between letting agents run next to production keys and babysitting them, and that "neither one scales."
Workspaces run as remote microVMs that sync each developer's working tree
Execution happens off the developer's machine, while the local editor and git workflow stay unchanged. Each agent gets an isolated environment, so dozens can work in parallel without colliding. Migrations, remediation campaigns and refactors can run for hours unattended. Security teams get visibility into what an agent read, ran and reached before approving its use.
Security controls include:
- MicroVMs built exclusively from zero-CVE Chainguard OS Packages, including FIPS-compliant toolchains, with dependencies verified against the lockfile at runtime.
- Real credentials injected outside the workspace; tools that need a credential on disk receive an encrypted, short-lived stand-in.
- Optional network egress policies that block unauthorized outbound requests from a prompt-injected agent or compromised dependency.
- A tamper-proof log of every credential call and network connection, plus signed attestations of the environment, code changes and check results for each run.
Snapshots resume idle workspaces in seconds and suspend after 10 minutes
Cache-hot microVM snapshots mapped to a specific repository and toolchain let teams launch or resume workspaces in seconds. Dependencies load from local disk as defined by the lockfile, removing external registry fetches. When an agent needs developer input, the workspace stays active for 10 minutes before suspending to a snapshot that preserves memory state, active processes and warm caches, with no compute spend while paused.
Chainguard Checks, also launching today in Beta, lets agents run CI suites in context and iterate until checks pass, tying the loop exit to verified results.
Cuscal joins as early design partner; IDC flags agent access as supply chain risk
Brad McCoy, Senior Manager, Cloud Platforms at Australian payments provider Cuscal, said the company is working with Chainguard as an early design partner and needs an environment where AI agents can iterate quickly without risking core systems.
IDC Research Director Katie Norton said organizations rank AI-generated code and agentic development workflows alongside third-party software and open source packages as top software supply chain concerns. She said agents running with developer-level credentials and broad network access extend the attack surface in ways many traditional controls were not designed to address.