nono is an open-source runtime security tool that sandboxes AI agents at the kernel level. Built by the team behind Sigstore, it wraps agent execution in enforced isolation — covering tools, credentials, network access and the supply chain — with zero setup and, its authors claim, zero latency overhead.
Autonomous agents run arbitrary tools with your credentials and network access, which makes their blast radius large when something goes wrong. nono addresses this with kernel-enforced sandboxing shipped as a single binary that needs no root privileges. Each tool an agent invokes can run in its own ephemeral sandbox with explicit permissions, and credentials are injected through a proxy as phantom tokens, so real secrets never enter the agent’s environment. Network egress is controlled with domain filtering and API rules, skills and packages can be verified with Sigstore attestation before they run, and encrypted audit logs plus rollback and recovery features make it possible to reconstruct or undo what an agent did. It runs on macOS, Linux and Windows via WSL2, and works with arbitrary agents including Claude Code, Codex and Copilot. The project emphasizes defense in depth: isolation, credential hygiene, network policy and supply-chain verification are enforced by the runtime, not requested from the model. nono is Apache-2.0 licensed, has more than 4,500 stars on GitHub, and was under active development in 2026.
Free. nono is open source under the Apache-2.0 license and runs locally on your own machines.
Developers and security teams running coding or general-purpose agents who need enforceable isolation, credential hygiene and auditable execution rather than prompt-level promises about agent behavior.