co:op

You need a sandbox

Coding agents do their best work unleashed, but that’s a gamble with your secrets and intellectual property.

Install co:op View on GitHub
  • Claude Code
  • Codex
  • Gemini
  • Grok

Claude Code

  • ~
    • .ssh/, out of reach
    • .aws/, out of reach
    • Documents/, out of reach
    • code/
      • billing/, out of reach
      • Sandboxshop/
        • src/
        • tests/
        • package.json
        • .env, empty inside the box
        origin, your Git remote: the agent cannot push to it
  • api.anthropic.com: reachable
  • any other site: blocked
  • origin, your Git remote: the agent cannot push to it

  1. co:op builds a box around your project

    The agent runs in a container with your project mounted at its real path.

    co:op does not mount your SSH keys, cloud logins or other repos.

    3 s to start the box once its image is built, network filter included, we measured.

  2. Secrets are replaced

    Files like .env stay where they are, but inside the box they’re replaced with empty files.

    coop check-secrets scans file contents for possible secrets.

    Hide more paths with .coopignore.

  3. Networking is restricted

    With filtered networking, the box reaches your AI provider and the destinations you approve.

    Other destinations are blocked. Your provider can still receive the files and prompts you give the agent.

  4. Review before you push

    co:op does not pass your host Git credentials to the box.

    The agent commits in your name. You review the work before pushing it and, optionally, sign it.

  5. But why?

    Agents can follow instructions hidden in code, docs or issues, even when an attacker wrote them.

    1. +32% more malicious prompt injections on the web in three months, Google found.

      A comment hidden in a README tells your agent to post your SSH key in an issue.

      Your SSH keys aren’t in the box, so there’s nothing to post.

    2. 1 in 3 companies faced prompt injection attacks on their AI apps within a year, Gartner found.

      An issue on a public repo tells your agent to publish your private code.

      co:op does not mount your GitHub credentials or other repos into the box.

      Filtered networking blocks destinations you have not approved.

    3. 13 of 13 frontier models fell to hidden instructions in a public attack competition, a 2026 study found.

      Hidden text in a setup guide tells your agent to send its Anthropic API key to an attacker.

      The box holds only a stand-in key that works for this run alone. The real key stays outside.

    4. 1.8 million malicious open source packages logged by mid-2026, Sonatype found.

      A package your agent installs sends your .env to a stranger’s server.

      In the box .env is empty, and that server can’t be reached.

  6. And sometimes agents just get it wrong

    A wrong path, an unexpected shell expansion, the wrong server.

    1. 56% of coding-agent runs on vague DevOps tasks went beyond what was asked, a 2026 study found.

      An agent cleaning up runs rm -rf tests/ plan/ ~/

      In the box, ~/ is a container home. Your own home folder stays outside.

    2. 80% of companies say their AI agents have taken unintended actions, SailPoint found.

      An agent uses your cloud CLI to SSH into production and drops the database.

      co:op does not mount your cloud logins or SSH keys. Filtered networking blocks servers you have not approved.

    3. 35% of the time, even the best of five recent models changed code that needed no change, a 2026 study found.

      A confused agent force-pushes over your team’s main branch.

      co:op does not pass your host Git credentials to the box.

  7. Not just for agents

    Supply chain attacks don’t need an agent. One poisoned package can read your keys the moment you install it.

    1,200+ new malicious packages a day in 2025, Sonatype found.

    Run your installs, tests and dev servers in the same box.

    # start your services$ coop up# and open a shell in the same box$ coop shell

The sandbox is the foundation. co:op builds everything else on top of it.

  1. Task queue

    Each task is a folder in your project. An agent picks one up, does the work and commits it.

    3,457 commits to co:op, Emisar and Ryker, written by agents in their own task queues.

    Put agents to work overnight

    [██████████████░░░░░░░░]  3 todo · 1 in_progress · 1 blocked · 3 done  ◰ Cache the /health DB probe (1/2) · busy claude  ○ Rate-limit the public API  ○ Backfill tests for the parser  ○ Document the config file  ⚑ Choose how long sessions last

  2. Loops

    coop loop works through the queue on its own, with a fresh agent for every task.

    A final review reopens unfinished work. A task that needs your decision waits for you, and the loop moves on.

    120 tasks finished in one 9-hour loop run during our normal work.

    ~/code/shop $ coop loop frontier━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Task 1 - Attempt 1 Make POST /checkout idempotent Agent  claude:claude-opus-5-5/xhigh@work Queue  0 completed · 1 active · 2 pending · 0 blocked━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Starting claude:claude-opus-5-5/xhigh@work✦ A retried checkout charges twice. I’ll key each order on its Idempotency-Key, so a replay returns the first charge.✎ Edit src/payments/checkout.ts⚙ Bash npm test✓ Task completed: Make POST /checkout idempotent━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Task 2 - Attempt 1 Cache the /health DB probe Agent  claude:claude-opus-5-5/xhigh@work Queue  1 completed · 1 active · 1 pending · 0 blocked━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Starting claude:claude-opus-5-5/xhigh@work✦ The probe counts orders on every call. Caching it for five seconds takes that load off the database.✎ Edit src/health.ts✓ Task completed: Cache the /health DB probe━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Task 3 - Attempt 1 Rate-limit the public API Agent  claude:claude-opus-5-5/xhigh@work Queue  2 completed · 1 active · 0 pending · 0 blocked━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Starting claude:claude-opus-5-5/xhigh@work✎ Edit src/middleware/rate-limit.ts⚙ Bash npm test✓ Task completed: Rate-limit the public API──────────────────────────────────────────────────────────────── Final review · Round 1 of 3 Agent  claude:claude-opus-5-5/xhigh@work Tasks  3 completed──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── Final review · 1 task needs more work  Rate-limit the public API Continuing the task queue────────────────────────────────────────────────────────────────━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Task 3 - Attempt 2 Rate-limit the public API Agent  claude:claude-opus-5-5/xhigh@work Queue  2 completed · 1 active · 0 pending · 0 blocked━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Starting claude:claude-opus-5-5/xhigh@work✦ Internal callers were throttled too. The limit now applies only to public routes.✎ Edit src/middleware/rate-limit.ts✓ Task completed: Rate-limit the public API──────────────────────────────────────────────────────────────── Final review · Round 2 of 3 Agent  claude:claude-opus-5-5/xhigh@work Tasks  1 completed────────────────────────────────────────────────────────────────✓ All tasks passed final review · 3/3 done

  3. Forks

    Hand work to agents, each in its own copy of your project, and keep working in yours.

    Review a fork like a pull request, then merge it. Set a project gate to check the rebased work before merging.

    +63% tickets per minute when developers’ parallel agents were planned, kept apart and tracked, Microsoft Research found.

    ~/code/shop $ coop fork api codex --loop -dCreating fork: api  /Users/you/code/shop-forks/api✓ Started fork api in the background  Agent: codex  Logs:  coop fork logs api --follow  Stop:  coop fork stop api~/code/shop $ coop fork lsForks  api · ready to merge · updated 4 minutes ago    Agent: codex    Branch: api    Tasks: 1 ready to merge    Changes: +88 −6Review a fork: coop fork review <name>~/code/shop $ coop fork review api --statChanges in fork api  Into: main  2 commits · 3 files · +88 −6Commits  9c41e2a webhook: verify Stripe signatures  3a7f0db webhook: dedupe replayed events by idFiles  code:    M  src/webhook/handler.ts  +40 -6    A  src/webhook/verify.ts  +24 -0  tests:    A  tests/webhook.test.ts  +24 -0Project checks will run when you merge.~/code/shop $ coop fork merge apiMerge fork api into main  2 commits · +88 −6Merge these commits? [Y/n] yRebasing onto mainRunning project checks  Running: npm test✓ Merged fork api into main

  4. Rotate providers, accounts and models

    You choose the accounts, models and providers to fall back on, in order. When one hits its usage limit, the loop moves to the next and keeps going.

    Editor sessions switch the same way.

    30% of engineers surveyed had hit their AI tools’ usage limits, and switching tools was a common response, The Pragmatic Engineer found.

    1. claude:opus@work100%limit reached
    2. claude:opus@home40%running
    3. codex:gpt-6-astra@work0%
    4. codex:gpt-6-astra@home0%

  5. Presets

    A preset is a team of models: one lead, and as many roles as you need. The lead consults them or hands them work.

    coop presets init writes a starter team you can change.

    +47 points on competition math when a team of agents mixed models from two labs instead of copies of one, 70% to 23%, a 2025 study found.

    $ coop frontier

    leadOpus 5.5
    • thinkerFable 5.1adviser
    • criticGPT-6 Astraadviser
    • fastGemini 3.8 Flasheditor

  6. Project services

    Run Postgres, Redis and other supported Compose services beside the box, each in its own container.

    In filtered mode, approved services use a private network with no direct internet access. Secret files stay hidden unless you approve access.

    $ coop up

    Private network
    Sandbox

    Claude Code

    shop/

    • db
    • redis

  7. Integrations

    Steer the sandboxed agent from Zed, or any editor that speaks ACP, with account rotation built in.

    Or connect co:op workers to your own platform, which hands out the jobs. Models never see your GitHub credentials.

    65% of agent sessions in Zed over the last 30 days ran an outside agent like Claude or Codex over ACP, Zed’s metrics show.

    Zed's agent panel running co:op, its provider menu open on Claude Code, Codex, Gemini CLI and Grok, beside menus for the preset, account, model and effort

Get started

Free and open source. Runs on macOS and Linux with Docker.

Installcurl -fsSL https://coop.dryga.com/install.sh | sh
Sign incoop login claude
Set upcd your-project && coop init
Startcoop claude

Set up your first sandbox