Koala runs each AI agent in its own Linux VM on a Mac, and the API key never goes inside

Chris, arms folded, stands beside a row of small sealed glass boxes, each holding a tiny busy invented figure, while a key sits locked in a small safe outside them. — Illustration: LockerGnome

Kunal Kushwaha (@kunalkushwaha, per his GitHub profile) posted the first Koala preview on October 7. Seventeen days and thirteen releases later, the Mac build sits at 0.1.0-preview.11, and a Linux build went up this morning.

The pitch fits in one line from the project page: “No host files, no secrets, no LAN, no other VMs, until you grant them.” A new VM starts with nothing. You hand it a folder, a network, or a key one at a time.

The key is the clever part. You write a policy, say an OpenAI template pinned to one model, then create a VM with the internet off and the broker on. Inside, the agent gets a base URL to talk to. The real key lives on the Mac side. “The broker adds a key only to the requests a policy allows, so it never enters the VM,” the page says.

There’s no root daemon, either. A per-user launchd manager keeps track of your VMs, which also means they stop when you log out or restart.

The release notes are refreshingly blunt about what’s missing. Preview.11 lists hostile-root testing, the secret-free broker and crash testing as done, and endurance, storage and memory pressure, and density checks as not done yet. The project page says it plainly: “Koala’s security work is not complete, so use it with workloads and on machines you trust.”

That leaves the obvious question hanging. The tool built so you don’t have to trust the agent still asks you to trust the tool, at least until those last checks land.

Why it matters

Most agent sandboxes still hand over the keys. The usual setup gives the agent a container and an environment variable with your API key in it. Anything that runs in there, including a poisoned package or a prompt injection, can read that variable and walk off with it. Koala moves the key to the other side of the wall.

A VM is a thicker wall than a container. Each Koala VM boots its own Linux kernel. A container shares the host’s kernel, so one kernel bug is one escape. Here, the guest’s root user is treated as hostile by design, and the release notes say that case was tested.

The policy is what the agent can spend, written down. A broker that only forwards requests a policy allows turns “the agent has my OpenAI key” into “the agent can call this one model through this one door.” That’s a budget line you can read, not a secret you hope stays put.

Expect “the agent never holds the credential” to become the default, the way nobody ships a web app with the database password in the browser anymore. The broker pattern is cheap to copy, and every agent framework that still passes keys through environment variables is one leaked token away from adopting it.

The bigger shift is where the sandbox lives. Koala runs on the laptop, under your own login, with no root daemon. If that holds up through the endurance and density tests, running ten agents locally in ten disposable VMs stops being an infrastructure project and becomes a Homebrew install. The Linux previews wrap every helper in Landlock, seccomp and namespaces, so the next thing to watch is whether the Mac build catches up and drops the “preview” label.

Steal this

Before you give an agent an API key, ask whether it can call the API without holding the key. If a proxy or broker can add the key on the way out, put the key there and give the agent only the address. This is like giving the valet the car but keeping the house key on a separate ring.
Start every agent sandbox with nothing and grant one thing at a time. No shared folders, no LAN, no internet until the task needs it, then write down what you granted and why. Kind of like packing a carry-on: you add what the trip needs instead of emptying the closet into it.
Read the “not done” list before you trust a security tool. Koala’s release notes say exactly which tests haven’t run yet, so use it on test machines and throwaway projects until they do. This is like checking which floors the inspector signed off on before you move in upstairs.

Search

Koala runs each AI agent in its own Linux VM on a Mac, and the API key never goes inside

More Infrastructure