Image by Nareeta Martin
Stanford's Secure Computer Systems group released jai, a free, open-source tool that gives AI coding agents — Claude Code, Codex, whatever you're running — a lightweight sandbox with zero setup. One command. No Docker. No Dockerfiles. Just jai claude and your home directory is protected by a copy-on-write overlay.
What jai Actually Does
Three isolation modes cover the spectrum:
Casual uses a copy-on-write overlay on your home directory. Your project's working directory stays writable — full access to write code, run tests, do whatever the agent needs. Everything else is read-only or overlaid. If the agent tries to modify your SSH keys or shell config, those writes go to a temporary layer that disappears when the session ends.
Strict goes further — separate unprivileged user, empty home directory. The agent can only see and touch what you explicitly grant.
Bare keeps your UID but hides your home directory entirely.
The key design decision: CWD stays writable in every mode. The agent can do its job. It just can't wander.
596 points and 311 comments on Hacker News. Developers want this.
Why This Is a Bigger Deal Than It Looks
Most companies running AI coding agents right now give them full filesystem access. Full. Filesystem. Access. The agent can read your .env files, your SSH keys, your AWS credentials, your browsing history — anything your user account can touch.
That's been the default because the alternative was "build a Docker container," and nobody building a quick feature wants to stop and write a Dockerfile first. The friction was too high, so everyone just... didn't bother.
jai eliminates that excuse. One command. Same workflow. Meaningful blast-radius reduction.
This matters because the agent security layer is becoming a distinct infrastructure category. NVIDIA shipped OpenShell at GTC for enterprise-grade containment. Now Stanford ships jai for developer-grade containment. Both ends of the spectrum are getting covered simultaneously.
What Engineering Leaders Should Do
If your teams are running Claude Code or Codex without any containment, you have an unmanaged risk surface. You might not have had a breach yet. But the attack surface is there — and it grows with every agent session.
Three steps:
1. Audit your current agent permissions. Most teams don't even know what their agents can access. Run a quick survey: which tools, which access levels, which directories?
2. Implement casual containment now. jai is free, instant, and adds negligible friction. There's no reason to wait for a perfect security policy when you can get 80% of the protection today.
3. Start building your agent security policy. Casual containment is the floor. As agent capabilities expand — and they will — you need a framework for deciding what agents can access, when, and under what conditions.
The pattern is clear: AI agents are getting more capable and more autonomous. The containment layer needs to keep pace. Stanford just made the first step trivially easy.
Jason Vertrees is founder and CTO of Heavy Chain Engineering, an AI-native software consultancy specializing in harness engineering, AI-driven SDLC, and fractional CTO services for teams scaling with AI.
Happy thinking, Jason