Kaioshin Is Open Source — Sandbox Your AI Coding Agent in 60 Seconds
Your AI Agent Has Root-Level Access to Your Life
Not literally root. Worse — it has your permissions.
Every file you can read, your AI coding agent can read. Your Chrome passwords stored in Login Data? Readable. Your Keychain database? Readable. Your SSH private keys, your .env files with API secrets, your Telegram chat history, your crypto exchange session tokens? All readable.
This isn't a vulnerability. It's how Unix permissions work. The agent runs as you.
Claude Code, Cursor, Copilot, Windsurf, Devin — none of them are malicious. But they execute code. They run shell commands. They read files based on context. And in the age of prompt injection, one poisoned README in a cloned repo could tell your agent to cat ~/.ssh/id_ed25519 and POST it somewhere.
Probably won't happen. But it can. And "probably won't" is not a security policy.
Kaioshin: Now Open Source
Today we're releasing Kaioshin — a kernel-level sandbox for AI coding agents on macOS.
One command. Sixty seconds. Zero performance overhead.
git clone https://github.com/robbery107allianz-cell/kaioshin.git ~/.kaioshin
cd ~/.kaioshin && ./kaioshin install
kaioshin launch claudeThat's it. Your Claude Code session is now running inside a macOS sandbox-exec profile with 49 deny rules across 8 categories — and your coding workflow is completely untouched.
MIT License · macOS 12+ · Zero dependencies
What Does It Actually Block?
The short answer: everything that isn't your code.
| Category | What's Protected | Why |
|---|---|---|
| Browsers | Chrome, Firefox, Safari, Arc, Brave, Edge, Opera, Vivaldi, Tor | Passwords, cookies, sessions |
| Crypto | OKX, Binance, Coinbase, Trezor, Ledger, Exodus, MetaMask | Wallet keys, exchange tokens |
| Keychain | All .keychain-db files + security CLI | Master password store |
| SSH / GPG | ~/.ssh/*, ~/.gnupg/* | Private keys, agent sockets |
| Messaging | Telegram, Signal, Discord, WhatsApp, WeChat, Slack, iMessage | Chat history, session data |
| Dev Credentials | AWS, Docker, Kubernetes, npm, PyPI configs | Cloud access tokens |
| Hardware | Camera, microphone | Physical privacy |
| System | Cookies DB, Apple Account plists | Identity data |
Everything else is allowed. Git, npm, pip, python, node, cargo, your project files, your Desktop, your terminal — all work normally. You won't notice the sandbox exists until something tries to cross the line.
How It Works (The 30-Second Version)
Kaioshin uses sandbox-exec, a macOS kernel feature that enforces file access rules at the process level. It's not a VM. It's not a container. It's a syscall-level filter that the sandboxed process physically cannot bypass — not even with sudo.
The overhead? Essentially zero. The kernel checks a path against the deny list on each file operation. That's a hash lookup — nanoseconds. Your npm install won't be one millisecond slower.
The Design Philosophy: Allow Everything, Deny What Matters
Most security tools start from "deny all, allow selectively." That's why nobody uses them. Too much friction, too many false positives, too much time spent configuring allowlists.
Kaioshin does the opposite:
- Allow everything by default — zero friction for normal work
- Deny only what matters — 49 surgical rules, not 5,000
- Enforce at the kernel — not a config file the agent can read and circumvent
- Escape hatch when needed —
kaioshin check <path>before you launch,--allowfor intentional exceptions
In Dragon Ball, the Kaiōshin (界王神) is the Supreme Kai — the divine guardian who doesn't interfere with daily life but sets unbreakable rules against catastrophic threats. That's the design. You should forget the sandbox is there. Until something tries to read your wallet.
Real-World: What Does a Blocked Access Look Like?
Nothing dramatic. The sandboxed process simply gets a "Permission denied" error, as if the file doesn't exist. No crash, no alert popup, no log flood.
If you're debugging and something unexpectedly fails:
kaioshin check ~/.ssh/id_rsa
# → ❌ DENIED by rule: P1 — SSH/GPG keys
kaioshin check ~/projects/my-app/src/index.ts
# → ✅ ALLOWED (no matching deny rule)Need to temporarily allow something? You're in control:
kaioshin launch claude --allow ~/.ssh/id_ed25519The sandbox works for you, not against you.
Who Is This For?
Every developer using an AI coding agent on macOS. But especially:
- Security-conscious teams — Defense in depth. Your AI agent doesn't need access to Keychain to write React components.
- Open source contributors — You clone repos from strangers. Those repos contain READMEs, configs, and scripts that your AI agent will read and execute. Prompt injection is not theoretical.
- Anyone who runs AI agents daily — The attack surface grows with usage. Sandboxing is a one-time setup.
Quick Start
Requirements: macOS 12+ (Monterey or later). That's it. No Homebrew, no dependencies.
# 1. Clone
git clone https://github.com/robbery107allianz-cell/kaioshin.git ~/.kaioshin
cd ~/.kaioshin
# 2. Install (scans your system, generates a sandbox profile)
./kaioshin install
# 3. Launch any AI agent, sandboxed
kaioshin launch claude # Claude Code
kaioshin launch cursor # Cursor
kaioshin launch code # VS Code + Copilot
# Verify it's working
kaioshin status
kaioshin test # Runs 13 automated security testsThe install takes about 10 seconds. It scans your machine for installed apps, generates a tailored sandbox.sb profile, and links the CLI. No sudo required. No background daemon. No config files to maintain.
Star the repo if it's useful. It helps others find it.
Known Limitations (Honesty Policy)
No security tool is perfect. Here's what we know:
defaults readbypass — macOSdefaultscommand uses XPC (inter-process communication), which bypasses file-level deny rules. An agent could potentially read some app preferences viadefaults read. This is a macOS architecture limitation, not a Kaioshin bug.- macOS only —
sandbox-execis a macOS-specific feature. Linux has Landlock and seccomp-bpf — a port is possible but not planned yet. - Not a network firewall — Kaioshin blocks file access, not network requests. If you need network isolation, pair it with Little Snitch or a firewall.
We document these in the README. No hand-waving, no asterisks.
The Bigger Picture
AI coding agents are getting more capable every month. They're writing code, running tests, managing infrastructure, deploying to production. The industry is sprinting toward agents that can do everything.
Nobody is sprinting toward making sure they should.
The operating system's permission model was designed for humans — one user, one set of permissions. It was never designed for autonomous agents that execute arbitrary code based on natural language instructions from potentially untrusted sources.
Until that changes at the OS level, tools like Kaioshin are the gap filler. A thin, invisible, kernel-enforced boundary between "your agent can code" and "your agent can read your entire digital life."
Links & References
References:
- Apple Developer: XPC Services
- Simon Willison: Prompt Injection and AI Agent Security
- Greshake et al.: "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection" (2023)
- Linux Kernel Docs: Landlock LSM, seccomp
Comments
Post a Comment