dredozubov/hazmat — MacOS containment for AI agents — user isolation, kernel sandbox, pf firewall, DNS blocklist, backup…

Description and use

**Brief Summary (2‑3 sentences)**
dredozubov/hazmat is an open‑source macOS containment framework that secures AI agents through user isolation, a kernel‑level sandbox, pf firewall rules, DNS blocklisting, and automated backup/rollback, with its core logic formally verified in TLA+. By providing ready‑made security primitives and a Go‑based SDK/CLI, it lets developers add AI capabilities—such as RAG pipelines or autonomous agents—without building a secure stack from scratch.

**Value**

• **Security‑first foundation:** Eliminates the most common attack surface for on‑device AI agents (privilege escalation, network abuse, data leakage) with a verified sandbox and network controls.
• **Speed to prototype:** The SDK exposes clear API hooks, so teams can focus on model logic and workflow orchestration rather than low‑level OS hardening.
• **Formal verification:** TLA+ proofs give confidence that the containment policies behave as intended, reducing the need for extensive manual security testing.

**Practical Adoption Path**

1. **Clone the repo** and run the provided Docker‑less installer on a macOS development machine.
2. **Integrate** the Go SDK or invoke the CLI to wrap existing AI services (e.g., LangChain, LlamaIndex) inside the sandbox.
3. **Configure** firewall rules and DNS blocklists via the supplied YAML templates to match your organization’s network policy.
4. **Test** locally using the built‑in backup/rollback feature; once validated, promote the same containerized configuration to CI/CD pipelines for automated deployment.

**Production Readiness**

• **Activity & community:** 111 ★, recent commits (last updated 2026‑05‑14), and a small but active fork base indicate ongoing maintenance.
• **Maturity:** Core security components are TLA+ verified; the Go codebase is compact and well‑documented, making audits tractable.
• **Risk considerations:** License compliance and a final security audit of the upstream dependencies are still required, but no major metadata or supply‑chain issues have been identified. Overall, the project is solid enough for a serious pilot in a controlled production environment.

Problem

dredozubov/hazmat helps add AI capability without starting from a blank model stack.

Outcome

High for an OSS candidate: recent activity, adoption, and ecosystem signals are strong enough for a serious pilot.

Workflow

• prototype AI features
• build RAG or agent workflows
• evaluate model tooling

Evidence

macOS containment for AI agents — user isolation, kernel sandbox, pf firewall, DNS blocklist, backup/rollback. TLA+ verified.

Source