Agent Safehouse brings deny-first sandboxing to local agents on macOS

Agent Safehouse is an open-source project aimed at making local LLM coding agents safer on macOS. The key idea is straightforward: most agent tools inherit the full permissions of the logged-in developer account, while Safehouse flips that default and grants access only to the files and integrations an agent actually needs. The project documentation describes this as a deny-first model built around practical least privilege.

The implementation is intentionally narrow. Safehouse wraps Apple’s sandbox-exec, starts from a near deny-all baseline, and then opens the active repository for read/write access, selected shared folders for read-only access, and specific local overrides where needed. Sensitive paths such as ~/.ssh, cloud credentials, and unrelated repositories can remain explicitly denied. If an agent tries to step outside policy, the kernel blocks the syscall before the process can read or modify anything.

• The quick-start path is a single self-contained shell script.
• The docs include wrappers for tools such as Claude, Codex, and Gemini CLI.
• The policy design separates shared repo config from machine-local exceptions.
• The repo clearly frames Safehouse as a hardening layer, not a perfect security boundary.

That positioning matters. Modern local agents increasingly get shell access, package-manager access, filesystem writes, and sometimes ambient credentials. In that environment, telling an agent to “be careful” is weak protection. Shrinking the accessible surface area is much more defensible. Safehouse is interesting because it treats containment as a kernel-enforced default rather than an optional afterthought in the agent UI.

The release also reflects where the agent ecosystem is heading. As coding agents become normal developer tooling, the market is shifting from prompt quality alone toward containment, observability, and policy control. Safehouse does not promise perfect isolation against a determined attacker, but it does reduce the much more common failure mode: an over-permissioned assistant making a bad filesystem or secret-handling decision in a real working environment.

The community post is available on Hacker News. The original project materials are published on the official documentation site and in the GitHub repository.