Chainguard moves agent trust from prompts to the machine

Chainguard used Assemble London on Wednesday to move security into where coding agents work: Workspaces gives every agent a microVM without long-lived credentials, Checks turns CI into a signed verdict, Harness points Claude Mythos 5.1 at your running app, MCP reached general availability, and Libraries covers Go and .NET. The shared idea is to control the environment, not the agent.

What did Chainguard announce at Assemble London?#

Chainguard built its name on hardened container images and zero-CVE OS packages, and it used its London conference to move into the places where agents work. Five announcements, three of them betas:

• Chainguard Workspaces (beta): a remote microVM per developer and per agent. Packages install, scripts run and configs change inside it, so none of it touches a laptop that holds SSH keys and cloud credentials. Each one builds from Chainguard's zero-CVE OS packages and resumes from a warm snapshot in seconds (workspaces).
• Chainguard Checks (beta): CI compressed into a pre-commit check that humans and agents call from the chainctl CLI, a git hook, the GitHub App, an MCP tool call or an SDK. It runs in a warm microVM with dependencies pre-baked from the lockfile and returns a signed attestation binding environment, verdict and commit SHA (checks).
• Chainguard Harness (beta waitlist): points Anthropic's Claude Mythos 5.1 at a live copy of your application, built from source exactly as it ships to production, inside a microVM with no network egress and no credentials (harness).
• Chainguard MCP (GA): four servers that answer dependency questions with verified data. cg-oci confirms an image tag or digest exists before it lands in a Dockerfile, cg-apk finds Chainguard package equivalents by name, cg-versions checks whether a version is current or end of life, and cg-api reads organization policy and entitlements. Any MCP client works, including Claude Code and Cursor, over standard OAuth.
• Libraries for Go and .NET (early access): malware-scanned package endpoints with a configurable cooldown. During the beta, the scanner returned malware verdicts on more than 5,000 Go and .NET packages, and over 10 percent of those verdicts had no match in public sources at the time of detection. None of the packages reached a customer.

Workspaces and Checks are in beta, the Harness waitlist is open, and design partner Cuscal, which powers payment infrastructure for more than 90 banks, fintechs and corporates, has run Checks since the alpha. The full roundup is on the Chainguard blog.

Why the environment became the control#

Workspaces exists because of where agents run today. Chainguard's launch release puts it plainly: most agents have the same access as the developer who launched them, sitting right next to their credentials, cloud keys and production systems, and many developers now run a dozen agents or more at once. The controls teams reach for first, permission prompts and allowlists, depend on the agent choosing to follow the rules.

Dan Lorenc, Chainguard's CEO and co-founder, framed the tradeoff in the launch release: "Right now teams are choosing between letting agents run next to their production keys or babysitting them through approval prompts all day. Neither one scales."

The mechanical answer inside Workspaces is that real credentials never live in the VM. A host-side proxy injects short-lived credentials into outbound requests, tools that insist on a file get an encrypted stand-in that is useless if taken, and egress policies block and log everything the allowlist does not cover. The New Stack adds that a policy can terminate the microVM outright on an unauthorized connection. A flight recorder keeps every command, code change and network call in a tamper-proof log. When an agent reaches a decision it should not make alone, the workspace routes the question to a developer and suspends to a snapshot, spending no compute while it waits.

Checks closes the loop from the other side. A passing run produces the signed attestation, so a merge gate can verify the result instead of re-running the suite. A failing run returns structured logs the agent reads and corrects against. Inside a Workspace, a passing verdict is what ends the agent's loop. This is the governance argument from the Snyk session I wrote up earlier this week with hardware attached: rules that rely on voluntary adherence fail for people, and they fail for agents the same way.

Harness runs the attacker's playbook with proof attached#

The offensive version of this capability already exists. Three open-source agent frameworks ran a retail breach campaign since July at a mean of $25.46 per completed scan, and I wrote up the reconstruction from the attacker's own staging server in September. Harness is that arsenal pointed inward, sold as a service. You hand it a codebase, it builds the application as production sees it, boots it in a microVM with no egress and no credentials, and lets Claude Mythos 5.1 probe for logic flaws, injection and resource exhaustion. Anthropic restricts that model to Project Glasswing participants, which is why the offering runs through Chainguard, and through Claude Marketplace it can draw on an existing Anthropic commitment.

The discipline around the findings is the part a small team can copy. Exploits get replayed in fresh microVMs until they land every time. A fix counts only when the exploit succeeds against the original code and fails against the patched one. A Chainguard engineer reviews each report before a customer sees it. The first public finding is a vLLM flaw, fixed in v0.31.0 and tracked as GHSA-6cxc-2vcg-w5qc per The New Stack: in earlier versions, one client could force the output returned to other clients sharing the same engine, and the tampered response arrived looking like a normal completion with nothing in the logs. Multi-tenant backends dread exactly this failure mode.

Whether any of this gets adopted depends on patching appetite, and Chainguard paid for a number on it. The company commissioned Wakefield Research for its AI Exploit Gap survey, which asked 1,300 security leaders across nine markets: more than half said their organizations knowingly leave high or critical vulnerabilities unpatched at least sometimes, the figure reaches 66 percent at companies above $1 billion in revenue, and it sits at 27 percent below $250 million (The New Stack).

What carries over to a team of two#

None of this needs a vendor, and every piece runs on infrastructure you already operate. In the order I would apply it:

1. Move execution off the machine that holds keys. A container or VM with no SSH keys, no cloud credentials and no production access covers the core of what Workspaces sells. Docker does this today.
2. Deny egress by default and log what you allow. A prompt-injected agent or a compromised dependency phones home exactly once if the policy logs the attempt.
3. Inject credentials, never store them. Short-lived tokens handed out per request leave nothing worth stealing on disk.
4. Pin dependencies to the lockfile and verify at runtime. A package name an agent invented is still the cheapest supply chain attack there is.
5. End the agent's loop on a verified verdict. Let the test suite decide when the work is done, and keep the result logged so review can trust it later.
6. Record everything. Commands, diffs, network calls. The support agent on this site already runs this way on a small scale: a scripted fallback, and a trace I can read after every conversation.

Workspaces, Checks and Harness are betas with waitlists open, MCP is already generally available, and every claim above is a vendor's until customer reports land. The direction is legible regardless. The protocol layer around the agents needs the same treatment: a week later, OX Security's scan of 15,465 public MCP servers turned up tunnels to home machines and launch commands that execute verbatim. The controls that decided where code could run have moved one step earlier in the lifecycle, from the pipeline onto the agent's own machine, and a team that applies the pattern by hand this week will recognize the products whenever the waitlists clear.