Chainguard has launched two beta products aimed at a fast-emerging problem in software delivery: how to run code safely when that code may be written or modified by AI agents. The company’s new Chainguard Workspaces and Chainguard Checks offerings are designed to keep development environments isolated while moving testing closer to the point where code is written.
Chainguard Workspaces puts agent activity in a remote microVM
Workspaces gives each developer or agent a dedicated remote development environment built on hardened microVMs. Chainguard says the goal is to let teams run shell commands, install packages, edit configuration files and carry out parallel tasks without exposing a local laptop to generated code or third-party dependencies.
The product uses the chainctl develop command to synchronize a local working tree into the remote environment, including uncommitted changes. Sessions are snapshotted when a user detaches and can later resume with files, running processes and shell context intact.
That design also supports experimentation. Teams can create multiple isolated Workspaces for the same repository, allowing different agents to explore different fixes without sharing ports, caches or process state.
Credentials, logging and network controls
Chainguard says Workspaces keeps long-lived secrets out of the guest environment by using a host-side proxy that adds short-lived credentials only to approved outbound requests. Optional egress rules can block and record connections to endpoints that a team has not explicitly allowed.
The company also says it records commands, code changes and network calls in what it describes as a tamper-proof log. According to the announcement, that logging is intended to reduce the impact of a compromised dependency or a prompt-injected agent.
Chainguard Checks moves CI closer to the developer loop
The second beta product, Chainguard Checks, is aimed at continuous integration. It runs CI steps in separate warm microVMs built from Chainguard packages, with dependencies prepared from the project’s lockfile. If that lockfile changes, the snapshot pool is rebuilt.
Developers can trigger Checks from the command line, a pre-commit hook or the GitHub App. Agents can invoke it through an MCP server or SDK. Chainguard says the idea is to let developers and agents “test, fail, and fix code safely without waiting on slow CI.”
When Workspaces and Checks are used together, a Workspace suspends while tests are running. If a check fails, the resumed session gets structured logs, allowing an agent to make another change without reconstructing the environment. If the check passes, the system creates an attestation tied to the environment, result and commit.
Sam Katzen quoted the company’s approach in the announcement: “Every run produces a signed attestation binding the environment, verdict, and commit SHA, so merge gates can verify a passing result instead of re-running tests.”
Why this matters for AI coding agents
Chainguard’s launch reflects a broader shift in how teams are thinking about AI-assisted development. Coding agents often need broad permissions: they may install dependencies, edit configuration, run tests and execute commands repeatedly. Doing that on a developer machine can expose credentials and local services to untrusted code.
At the same time, sending every edit through a conventional CI system can create queues and duplicate dependency downloads. Chainguard is positioning Workspaces and Checks as a way to narrow both problems at once: isolate the execution environment and reduce the distance between code changes and validation.
The announcement does not include performance comparisons with existing CI platforms, and it does not explain how customers should independently verify the tamper-resistance of the logs. It also assumes trust in Chainguard’s execution and signing systems, since the attestation model depends on the inputs staying unchanged.
Beta availability and pricing
Workspaces currently supports Claude, with additional agents planned. Both Workspaces and Checks are available as 30-day beta trials, and pricing is based on consumed compute.
Chainguard also said the two products are part of a wider expansion across the build pipeline. Chainguard Actions is now generally available, with more than 1,000 rebuilt and continuously maintained GitHub Actions. In addition, Chainguard Libraries for Go and .NET has entered early access.
Libraries for Go and .NET add scanning and delay controls
Chainguard says its Libraries service scans dependencies for malware and greyware, adds a configurable delay before new packages become available, and backports selected vulnerability fixes. The company reported that its beta scanner returned verdicts on more than 5,000 Go and .NET packages, and that more than 10% had no match in public sources when detected.
That package work places Chainguard in a market with established alternatives. Sonatype Repository Firewall blocks or quarantines malicious and vulnerable packages before builds, while JFrog Curation applies security, licence and package-age policies at download time. For agent and build isolation, E2B runs sessions in Firecracker microVMs and StepSecurity Harden-Runner monitors network, file and process activity on GitHub Actions runners.
Part of a broader security pattern
The company’s pitch is notable because it combines several tools that are often sold separately: isolated execution, dependency hygiene, CI attestations and agent-friendly workflows. That combination may appeal to teams trying to adopt AI coding tools without loosening controls around secrets, build inputs and network access.
More broadly, the launch fits an industry trend toward using microVMs for untrusted build and agent workloads. InfoQ’s guidance on securing AI-accelerated development recommends isolated microVMs or tightly restricted containers, along with short-lived credentials and default-deny network access. Other recent approaches, including Amazon Bedrock AgentCore and Vercel’s Hive build system, have also leaned on microVM-based isolation.
Chainguard’s distinction, according to the announcement, is that it is trying to tie that isolation directly to its own package catalogue, CI attestations and agent loop.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cloud & DevOps Tech News
Last Modified: October 17, 2026 at 10:33 pm
1 views
