Chainguard 推出面向 AI 编程智能体的安全 Workspaces 与 Checks

Software supply chain security company Chainguard has announced two beta products for running and testing code written by developers and AI agents. Chainguard Workspaces provides remote development environments based on hardened microVMs, while Chainguard Checks moves continuous integration into the development loop. The company announced both products at its Assemble London event.

The releases respond to a practical problem with coding agents. Agents need permission to install packages, run shell commands and edit configuration. They may also run several tasks in parallel. Doing this on a developer laptop puts corporate credentials and local services within reach of generated or third-party code. Sending each change to a conventional CI service can instead create queues and repeatedly download the same dependencies.

Workspaces gives each developer or agent a dedicated remote microVM. The chainctl develop command synchronises a local working tree, including uncommitted changes, into the environment. A session is snapshotted when the user detaches and can resume with its files, processes and shell context. Teams can also create several isolated Workspaces for one repository so agents can try different solutions without sharing ports, caches or process state.

Chainguard says that a host-side proxy adds short-lived credentials to approved outbound requests, rather than placing long-lived secrets in the guest. Optional egress rules can block and record connections to endpoints that a team has not allowed. The company also records commands, code changes and network calls in what it describes as a tamper-proof log. Paxton and Phillips say this is intended to limit damage from a compromised dependency or a prompt-injected agent.

Checks runs CI steps in separate warm microVMs built from Chainguard packages. Dependencies are prepared from the project's lockfile and the snapshot pool is rebuilt when that file changes. Developers can invoke the same checks through the command line, a pre-commit hook or the GitHub App. Agents can call them through an MCP server or SDK. Paxton and Phillips describe the aim as letting developers and agents "test, fail, and fix code safely without waiting on slow CI".

When Checks and Workspaces are used together, a Workspace suspends while tests run. A failed check returns structured logs to the resumed session, allowing the agent to try another change without reconstructing its environment. A successful run creates an attestation tied to the environment, result and commit. The proposed merge gate can verify that evidence instead of running the test suite again.

"Every run produces a signed attestation binding the environment, verdict, and commit SHA, so merge gates can verify a passing result instead of re-running tests."
Sam Katzen

This design depends on the attested inputs remaining unchanged and on repositories trusting Chainguard's execution and signing system. The announcement does not publish performance data comparing Checks with established CI services. It also does not give details of how customers should validate the claimed tamper resistance of the logs. Workspaces currently supports Claude, with other agents planned, and is priced according to consumed compute. Both products are available as 30-day beta trials.

Chainguard made two other announcements relevant to build pipelines. Chainguard Actions is now generally available, with more than 1,000 rebuilt and continuously maintained GitHub Actions. Chainguard Libraries for Go and .NET has entered early access. The Libraries service scans dependencies for malware and greyware, applies a configurable delay before new packages become available, and backports selected vulnerability fixes. Chainguard reports that its beta scanner returned verdicts on more than 5,000 Go and .NET packages, and that over 10% had no match in public sources when detected.

Chainguard is entering markets with established alternatives. E2B runs agent sessions in Firecracker microVMs, controls egress and resolves credentials outside the guest. StepSecurity Harden-Runner monitors network, file and process activity on GitHub Actions runners and can enforce outbound network policies. For dependencies, Sonatype Repository Firewall blocks or quarantines malicious and vulnerable packages before builds, while JFrog Curation applies security, licence and package-age policies at download time. Chainguard's offer combines these areas with signed test results, rebuilt actions and remediated dependencies.

The use of microVMs for untrusted build and agent workloads is already established. InfoQ's guidance on securing AI-accelerated development recommends isolated microVMs or tightly restricted containers for agent-generated code, along with short-lived credentials and default-deny network access. Amazon Bedrock AgentCore gives each user session isolated CPU, memory and filesystem resources, while Vercel's Hive build system uses Firecracker microVMs and short-lived WireGuard tunnels. Chainguard's distinction is the way it combines this isolation with its own package catalogue, CI attestations and agent loop.