What If Your AI Coding Agent Deletes Your Project? Building a Zero-Trust Sandbox with Rust

AI coding agents are becoming an important part of modern software development.

Tools like Claude Code, OpenAI Codex, Aider, OpenHands, Cursor, and other autonomous coding agents can execute terminal commands, modify source files, install dependencies, and run scripts.

But there is one important question:

What happens when an AI agent executes a dangerous command on your actual development machine?

Imagine an agent accidentally:

  • Deletes important project files.
  • Overwrites your .env configuration.
  • Reads SSH keys or cloud credentials.
  • Modifies Git history.
  • Executes an untrusted installation script.
  • Makes unexpected outbound network connections.

A simple confirmation prompt isn't always enough.

I started building ShadowCLI to explore a different approach: putting a zero-trust security boundary between AI coding agents and the developer's machine.

Introducing ShadowCLI

GitHub: https://github.com/6t9xstar/shadowcli

ShadowCLI is an open-source, Rust-based execution sandbox for AI coding agents.

Instead of allowing commands to modify your actual project immediately, ShadowCLI executes them inside an isolated Linux environment.

Changes are captured in a temporary copy-on-write layer. Developers can inspect the resulting differences, review modifications, approve changes, or discard the session.

The goal is simple:

Let AI agents work, but keep developers in control of what reaches their actual projects.

How Does It Work?

ShadowCLI uses multiple Linux security mechanisms to isolate command execution.

Its architecture combines:

  1. Linux User Namespaces – Isolate user and group identities.
  2. Mount Namespaces – Provide a private filesystem view.
  3. PID Namespaces – Isolate processes.
  4. Network Namespaces – Restrict outbound network access by default.
  5. Landlock LSM – Enforce filesystem access restrictions.
  6. Seccomp BPF – Block selected high-risk system calls.
  7. OverlayFS / CopyFS – Capture filesystem modifications without directly changing the host project during execution.

These layers work together to create a defense-in-depth execution environment.

Getting Started

ShadowCLI is designed for Linux systems with the required kernel and sandbox capabilities.

1. Clone the repository 

git clone https://github.com/6t9xstar/shadowcli.git cd shadowcli

2. Build the project

You need Rust 1.80 or later.

cargo build --release

3. Install the binary 

sudo cp target/release/shadow /usr/local/bin/

4. Check system compatibility 

shadow doctor

This checks important system capabilities, including kernel compatibility, user namespaces, Landlock, Seccomp, and filesystem support.

5. Run a command inside the sandbox 

shadow run -- npm test

By default, outbound network access is blocked.

If a task requires network access, you can explicitly allow it:

shadow run --allow-network -- cargo build

You can also configure execution timeouts:

shadow run --timeout 30 -- ./agent-script.sh

Inspect Changes Before Applying Them

One of the most important parts of ShadowCLI is its review workflow.

After an agent executes commands, inspect the captured changes:

shadow diff

View a summary:

shadow diff --stat

Review modifications interactively:

shadow review

Apply approved changes:

shadow apply --all --yes

If you need to undo the most recent apply operation:

shadow apply --rollback

Or discard unapplied sandbox changes:

shadow discard

This creates a workflow where executing commands and accepting their modifications are separate decisions.

Who Can Use ShadowCLI?

ShadowCLI is designed as a general execution boundary for tools that execute terminal commands.

Potential integration targets include:

  • Claude Code
  • OpenAI Codex
  • Aider
  • OpenHands
  • Gemini CLI
  • OpenCode
  • Cline
  • Roo Code
  • Custom AI coding agents

For example, you can wrap a terminal-based agent command:

shadow run -- aider

You can also integrate sandboxed command execution into your own Python-based agent:

import subprocess result = subprocess.run( [ "shadow", "run", "--project", ".", "--allow-network", "--", "npm", "test" ], capture_output=True, text=True ) print(result.stdout) print(result.stderr)

Actual compatibility depends on how an agent interacts with the filesystem and launches subprocesses.

Security Is More Than a Confirmation Prompt

I believe AI-assisted development needs more than a simple permission dialog.

A secure execution workflow should consider:

  • Filesystem isolation.
  • Credential protection.
  • Network restrictions.
  • Process isolation.
  • System call restrictions.
  • Change inspection.
  • Explicit approval.
  • Recovery and rollback.

ShadowCLI brings these ideas together using native Linux security technologies and Rust.

It is not a replacement for security auditing, backups, or a hardened virtual machine. Its protection also depends on the host kernel, filesystem, configuration, and the correctness of its isolation mechanisms.

Open Source and Contributions

ShadowCLI is released under the Apache-2.0 license.

I'm continuing development and would appreciate feedback from developers working with:

  • Rust and Linux systems programming.
  • AI coding agents.
  • Linux kernel security.
  • Sandboxing and container isolation.
  • DevSecOps and application security.

If you're interested in this area, explore the repository, review the implementation, report issues, or contribute improvements.

GitHub Repository: https://github.com/6t9xstar/shadowcli

I'd particularly like to hear your thoughts:

Would you trust an AI coding agent with unrestricted access to your development machine, or would you prefer every modification to go through an isolated execution and review process?

Let's discuss.