{{sprite}}
co:op

You need a sandbox

Coding agents do their best work unleashed, but that's a gamble with your secrets and intellectual property.

Install co:op View on GitHub
{{providers}}
{{scene}}

  1. co:op builds a box around your project

    The agent runs in a container with your project mounted at its real path.

    co:op does not mount your SSH keys, cloud logins or other repos.

    3 s to start the box once its image is built, network filter included, we measured.

  2. Secrets are replaced

    Files like .env stay where they are, but inside the box they're replaced with empty files.

    coop check-secrets scans file contents for possible secrets.

    Hide more paths with .coopignore.

  3. Networking is restricted

    With filtered networking, the box reaches your AI provider and the destinations you approve.

    Other destinations are blocked. Your provider can still receive the files and prompts you give the agent.

  4. Review before you push

    co:op does not pass your host Git credentials to the box.

    The agent commits in your name. You review the work before pushing it and, optionally, sign it.

  5. But why?

    Agents can follow instructions hidden in code, docs or issues, even when an attacker wrote them.

    1. +32% more malicious prompt injections on the web in three months, Google found.

      A comment hidden in a README tells your agent to post your SSH key in an issue.

      {{check}}Your SSH keys aren't in the box, so there's nothing to post.

    2. 1 in 3 companies faced prompt injection attacks on their AI apps within a year, Gartner found.

      An issue on a public repo tells your agent to publish your private code.

      {{check}}co:op does not mount your GitHub credentials or other repos into the box.

      {{check}}Filtered networking blocks destinations you have not approved.

    3. 13 of 13 frontier models fell to hidden instructions in a public attack competition, a 2026 study found.

      Hidden text in a setup guide tells your agent to send its Anthropic API key to an attacker.

      {{check}}The box holds only a stand-in key that works for this run alone. The real key stays outside.

    4. 1.8 million malicious open source packages logged by mid-2026, Sonatype found.

      A package your agent installs sends your .env to a stranger's server.

      {{check}}In the box .env is empty, and that server can't be reached.

  6. And sometimes agents just get it wrong

    A wrong path, an unexpected shell expansion, the wrong server.

    1. 56% of coding-agent runs on vague DevOps tasks went beyond what was asked, a 2026 study found.

      An agent cleaning up runs rm -rf tests/ plan/ ~/

      {{check}}In the box, ~/ is a container home. Your own home folder stays outside.

    2. 80% of companies say their AI agents have taken unintended actions, SailPoint found.

      An agent uses your cloud CLI to SSH into production and drops the database.

      {{check}}co:op does not mount your cloud logins or SSH keys. Filtered networking blocks servers you have not approved.

    3. 35% of the time, even the best of five recent models changed code that needed no change, a 2026 study found.

      A confused agent force-pushes over your team's main branch.

      {{check}}co:op does not pass your host Git credentials to the box.

  7. Not just for agents

    Supply chain attacks don't need an agent. One poisoned package can read your keys the moment you install it.

    1,200+ new malicious packages a day in 2025, Sonatype found.

    Run your installs, tests and dev servers in the same box.

    {{own_runs}}

The sandbox is the foundation. co:op builds everything else on top of it.

  1. Task queue

    Each task is a folder in your project. An agent picks one up, does the work and commits it.

    3,457 commits to co:op, Emisar and Ryker, written by agents in their own task queues.

    Put agents to work overnight

    {{queue}}

  2. Loops

    coop loop works through the queue on its own, with a fresh agent for every task.

    A final review reopens unfinished work. A task that needs your decision waits for you, and the loop moves on.

    120 tasks finished in one 9-hour loop run during our normal work.

    {{loop}}

  3. Forks

    Hand work to agents, each in its own copy of your project, and keep working in yours.

    Review a fork like a pull request, then merge it. Set a project gate to check the rebased work before merging.

    +63% tickets per minute when developers' parallel agents were planned, kept apart and tracked, Microsoft Research found.

    {{fork}}

  4. Rotate providers, accounts and models

    You choose the accounts, models and providers to fall back on, in order. When one hits its usage limit, the loop moves to the next and keeps going.

    Editor sessions switch the same way.

    30% of engineers surveyed had hit their AI tools' usage limits, and switching tools was a common response, The Pragmatic Engineer found.

    {{rotate}}

  5. Presets

    A preset is a team of models: one lead, and as many roles as you need. The lead consults them or hands them work.

    coop presets init writes a starter team you can change.

    +47 points on competition math when a team of agents mixed models from two labs instead of copies of one, 70% to 23%, a 2025 study found.

    {{team}}

  6. Project services

    Run Postgres, Redis and other supported Compose services beside the box, each in its own container.

    In filtered mode, approved services use a private network with no direct internet access. Secret files stay hidden unless you approve access.

    {{services}}

  7. Integrations

    Steer the sandboxed agent from Zed, or any editor that speaks ACP, with account rotation built in.

    Or connect co:op workers to your own platform, which hands out the jobs. Models never see your GitHub credentials.

    65% of agent sessions in Zed over the last 30 days ran an outside agent like Claude or Codex over ACP, Zed's metrics show.

    {{integrations}}

Get started

Free and open source. Runs on macOS and Linux with Docker.

{{install}} {{cmd_login}} {{cmd_init}} {{cmd_run}}

Set up your first sandbox