AI agent sandbox guide
How to run an AI agent on your Mac without giving it your Mac
The short answer: give the agent a virtual machine, not your user account. Snapshot before it starts, clone a disposable copy for anything you do not trust, and cut the network when the task does not need one. This guide compares the isolation options on Apple Silicon and walks through the workflow with Kyvenza’s built-in MCP server.
What each kind of isolation actually protects
Your own user account: no isolation
An agent that runs shell commands as you has everything you have: the Keychain, SSH keys, browser sessions, cloud credentials and every file you can read. A bad command or a prompt injection has the same reach you do.
A second macOS user: files separated, OS shared
A separate account keeps your home folder and Keychain out of reach, but it is the same operating system and kernel. It helps against accidents, less against an agent that is given admin rights.
A container: good for Linux tools, with caveats
Containers on a Mac run inside a Linux virtual machine and share its kernel. They suit headless Linux tooling, but a mounted host folder or the Docker socket hands the agent a way back out, and they cannot run macOS or Windows apps.
A virtual machine: a boundary the hypervisor enforces
The guest is a separate operating system. It cannot see your host files unless you share them, and a snapshot lets you roll the whole machine back after a bad action. This is the sweet spot for coding agents on one Mac.
A dedicated machine: strongest, and a second device
A spare Mac mini gives physical separation. It also costs money, needs setting up and adds a device to maintain. A VM gets most of the isolation on the Mac you already own.
A Kyvenza VM vs a Docker container for agent work
Containers are fine for many agent tasks, and quick to create. The differences that matter appear when the agent needs a full desktop, a macOS or Windows guest, or a stronger boundary.
| Feature | Kyvenza | Docker container |
|---|---|---|
| Guest operating system | Linux ARM, macOS ARM or Windows 11 ARM | Linux only |
| Isolation boundary | A separate OS enforced by the hypervisor | A shared Linux kernel inside one Docker virtual machine |
| Roll back after a bad action | Restore a snapshot; via MCP, one is taken automatically before an agent starts a VM | Rebuild the container and restore any volumes |
| Disposable copy | clone_vm: copy-on-write, appears in about a second | Yes, new containers start quickly |
| No network at all | Isolated networking; on Linux the guest agent still runs commands and takes screenshots | Yes, with a no-network setting |
| See the screen | screenshot tool on a full desktop guest | Terminal only unless you add a desktop |
| Best fit | Agents that need a real desktop or macOS, and untrusted installers | Headless Linux tooling and CI |
What Kyvenza supports today
A short, honest list — so you know what to expect before you download.
Supported today
- Apple Silicon Macs (M1, M2, M3, M4, M5)
- Windows 11 on ARM (bring your own Microsoft image and licence)
- Ubuntu ARM (LTS releases)
- Debian ARM
- Fedora ARM
- macOS 14 Sonoma or later as host
- Native Apple Virtualization framework backend
Not supported yet
- GPU / 3D acceleration in Windows guests
- USB passthrough and microphone input in Windows guests
- x86 / Intel guest operating systems
- Nested virtualization
- GPU passthrough
We list what we cannot deliver today so you can plan accordingly.
How it works
Prepare a clean base VM
Create a Linux or macOS guest in Kyvenza, install the tools the agent will need, and shut it down. This is your known-good base. Do not put personal credentials in it.
Turn on the MCP server and connect your agent
In Settings, then Automation, switch the server on and copy the endpoint, which already carries your Mac’s token. In Claude Code the connection is one command: claude mcp add --transport http kyvenza http://127.0.0.1:59800/mcp/YOUR-TOKEN. Any MCP client that accepts a URL works.
Clone, run, read the result, delete
With destructive tools enabled, the agent clones the base into a sandbox, runs the installer or script inside it, reads the output and deletes the clone. The clone is copy-on-write, and deletes go to the Trash. For code that must not phone home, set the VM to isolated networking first.
Frequently asked questions
Not on your main account. An agent that can run shell commands as you can read your Keychain, SSH keys and browser sessions, so a bad command or a prompt injection has the same reach you do. Run it in a virtual machine that holds none of your credentials, and snapshot before it starts.
Give the agent a machine of its own
Download Kyvenza, turn on the MCP server and let your agent work in a VM you can snapshot and throw away. $49 once after the 7-day trial.
Other comparisons