Chainguard launches secure workspaces and in-loop checks for AI coding agents

Beta tools isolate agent code in hardened microVMs, add short-lived credentials and faster failure feedback

By LineZotpaper

Published16 October 2026

Read Time3 min

Software supply chain security company Chainguard has announced two beta products for running and testing code written by developers and AI agents. Announced at its Assemble London event, Chainguard Workspaces provides remote development environments based on hardened microVMs, while Chainguard Checks moves continuous integration into the development loop.

Software supply chain security company Chainguard has announced two beta products for running and testing code written by developers and AI agents. Chainguard Workspaces provides remote development environments based on hardened microVMs, while Chainguard Checks brings continuous integration into the development loop. Both were announced at the company's Assemble London event.

The releases respond to a practical problem with coding agents. Agents need permission to install packages, run shell commands and edit configuration, and may run several tasks in parallel. Doing this on a developer laptop puts corporate credentials and local services within reach of generated or third-party code, while sending each change to a conventional CI service can create queues and repeatedly download the same dependencies.

Workspaces gives each developer or agent a dedicated remote microVM. The chainctl develop command synchronises a local working tree, including uncommitted changes, into the environment. A session is snapshotted when the user detaches and can resume with its files, processes and shell context. Teams can also create several isolated Workspaces for one repository so agents can try different solutions without sharing ports, caches or process state.

Chainguard says a host-side proxy adds short-lived credentials to approved outbound requests rather than placing long-lived secrets in the guest. Optional egress rules can block and record connections to endpoints a team has not allowed. The company also records commands, code changes and network calls in what it describes as a tamper-proof log, an approach it says is intended to limit damage from a compromised dependency or a prompt-injected agent.

Checks runs CI steps in separate warm microVMs built from Chainguard packages. Dependencies are prepared from the project's lockfile, and the snapshot pool is rebuilt when that file changes. Developers can invoke the same checks through the command line, a pre-commit hook or the GitHub App, while agents can call them through an MCP server or SDK. The aim, according to the company, is to let developers and agents "test, fail, and fix code safely without waiting on slow CI."

When Checks and Workspaces are used together, a Workspace suspends while tests run. A failed check returns structured logs to the resumed session, allowing the agent to try another change without reconstructing its environment. A successful run creates an attestation tied to the environment, result and commit, and the proposed merge gate can verify that evidence instead of running the suite again.

Analysis

Why This Matters

AI coding agents are moving into everyday developer workflows, but they need broad permissions to install packages, run shell commands and edit configuration, which can expose corporate credentials if executed on a laptop.
Chainguard's approach moves agent work into isolated, hardened microVMs with short-lived credentials, egress controls and tamper-proof logging, addressing both security exposure and the slow feedback loops of conventional CI.
The products signal that software supply chain security is being extended specifically to AI-generated and AI-modified code, an area most existing tools do not yet cover.

Background

Chainguard is a software supply chain security company best known for building minimal, continuously patched container images and tools for verifying software provenance. Its new products extend that focus to AI coding agents, who generate changes that must be executed and tested somewhere. Isolating untrusted code in a separate environment, injecting credentials only when needed and recording evidence for later verification are established ideas in secure development; the new tools apply them to the specific case of agent-driven workflows, where many parallel attempts may be running at once.

Key Perspectives

Development teams: Gain a way to let agents work in parallel on isolated environments without exposing local credentials, and get faster feedback than waiting in CI queues. Structured logs returned to a resumed workspace are designed to let agents correct their own failed changes quickly. Security teams: The egress rules, short-lived credentials and tamper-proof logs provide visibility and control over what agents can reach, while attestations create verifiable evidence of what code was tested and in what environment before it merges. Critics/Skeptics: The offerings are betas, and the merge gate only helps if teams actually verify attestations across the whole pipeline. Running warm pools of microVMs could add cost and operational complexity, and no isolation layer removes the need to review what permissions agents are granted in the first place.

What to Watch

Whether Chainguard moves either product from beta to general availability and how it prices the snapshot and microVM pools.
Whether teams adopt the proposed merge gate and verify attestations before merging agent-written code, or treat it as an optional extra.
How deeply the tools integrate with major agent platforms and CI systems beyond GitHub, and whether competing security vendors respond with similar agent-focused isolation offerings.

Sources

Chainguard Launches Secure Workspaces and Checks for AI Coding Agents — InfoQ