Chainguard Launches Secure Workspaces and Checks for AI Coding Agents
New beta tools provide isolated microVM environments and CI integration for AI-generated code.
1New Secure Development Infrastructure
Chainguard introduced two beta products, Workspaces and Checks, designed to secure AI-driven development workflows. These tools address security risks by running code in hardened microVMs rather than on local developer machines. The announcement took place at the Assemble London event, marking a strategic expansion into agent-based development security.
2Mitigating AI Agent Security Risks
Coding agents often require broad permissions to install packages and modify configurations, creating significant security vulnerabilities. By using dedicated remote microVMs, Chainguard prevents generated code from accessing corporate credentials or local services. This isolation ensures that third-party or AI-written code remains contained within a secure, ephemeral environment.
3Workspaces and Session Persistence
Chainguard Workspaces synchronizes local working trees via the chainctl develop command. Sessions are snapshotted upon detachment, allowing developers or agents to resume work with existing file states and shell contexts. Teams can deploy multiple isolated workspaces for a single repository, preventing conflicts between different agent-driven solutions or parallel tasks.
4Credential Management and Egress Control
The platform utilizes a host-side proxy to inject short-lived credentials into approved requests, avoiding long-lived secrets within the guest VM. Teams can enforce optional egress rules to block unauthorized network connections. Furthermore, all commands, code changes, and network calls are recorded in a tamper-proof log to limit potential damage.
5Integrating CI into Development Loops
Chainguard Checks moves continuous integration steps directly into the development loop using warm microVMs. Developers can trigger these checks via command line, pre-commit hooks, or GitHub Apps. Agents interact through an MCP server or SDK, enabling rapid testing cycles without the latency typically associated with conventional CI service queues.
6Attestation and Merge Gates
When used together, Workspaces and Checks create attestations linked to the environment, test results, and specific commits. This allows for a proposed merge gate to verify evidence rather than re-running the entire test suite. The system relies on the integrity of attested inputs and trust in Chainguard’s signing infrastructure.
7Expanded Ecosystem and Package Security
Beyond the new beta products, Chainguard made Chainguard Actions generally available with over 1,000 maintained GitHub Actions. Additionally, Chainguard Libraries for Go and .NET entered early access. This service scans dependencies for malware, applies configurable delays for new packages, and backports vulnerability fixes to ensure a secure supply chain.
8Market Positioning and Competitive Landscape
Chainguard enters a competitive market alongside established players like E2B, StepSecurity, and JFrog. While competitors focus on specific areas like network monitoring or package curation, Chainguard differentiates itself by combining isolated microVMs, signed test attestations, and remediated dependencies. Both new products are currently available as 30-day beta trials.
Original article: InfoQ — Chainguard Launches Secure Workspaces and Checks for AI Coding Agents