Launching today
kosa8
Air-gapped microVM sandboxes for enterprise AI agents
101 followers
Air-gapped microVM sandboxes for enterprise AI agents
101 followers
kosa8 is security infrastructure for enterprise internal AI agents. Every agent gets its own microVM with its own kernel, on your Macs, your Linux servers, your cloud, or fully air-gapped. The agent sees one folder, API keys stay on the host (the sandbox holds a placeholder), and the network is closed except the hosts you allow. Rewind the whole machine in about a second when an agent gets it wrong. Docker-compatible, MCP-native, hash-chained audit, signed releases.
Free Options
Launch Team / Built With
AWS Activate CreditsCredits that fuel your startup’s next milestone
Promoted
@letizia_sorrentino
@mauriciomk
@luiz_eduardo_carvalho kosa8 architecture. The host daemon is the trusted computing base: it identifies callers,
gates actions, enforces egress, holds credentials, and writes the audit chain. Sandboxes are
untrusted microVMs, each with its own kernel, container engine, disks and private L2 network. A
separate shared engine VM
@Priya K Yes, there's no rewrite. Register your existing server with kosa8 mcp add NAME -- and it runs in its own sealed sandbox behind the gateway, with tool allow-lists, egress limits, allow/deny/ask rules and a full audit log. Then point your agent at kosa8 mcp serve. The only change is that tool names get a prefix (name_tool).
How does kosaa keep an AI agent contained if it tries to access something outside its allowed environment?
Hi everyone! Enterprises are rolling out AI agents everywhere: support and operations agents, data analysis and research agents, document agents in legal and finance, triage assistants in hospitals, SOC agents in security teams, and coding agents too. Most of them run with far more access than they need. One injected instruction or poisoned tool can reach your data, your credentials and your network.
kosa8 gives every agent its own sealed machine instead.
Built for closed-door environments: banks and fintech, hospitals and pharma, government and defence, law firms, telecom, energy, manufacturing and OT, research labs, and any internal team that can't let data leave the building.
What it does, for any agent:
A real microVM per agent, with its own kernel (Apple Virtualization framework or KVM), not a shared container
The agent only sees the folder or data you give it; API keys stay on the host and the sandbox only holds a placeholder
Network closed by default, enforced on the host where the agent can't reach the rules
Every tool server (MCP) sandboxed behind one policy gateway
Checkpoint, fork and rewind the whole machine in about a second
Hash-chained audit and signed evidence a third party can verify
Air-gapped by design: run it on your Macs, Linux servers or cloud, or fully air-gapped. Nothing has to leave your network. Docker-compatible, so existing agent containers work unchanged.
Measured, not claimed. We published a 46-page technical report (K8-TR-2026-01) with the attacker as root inside the agent's machine. Key results for kosa8 v0.9.36: all 13 requirements for regulated use fully met (the only one of 11 agent sandboxes compared; the next best meets 4), 1,142 tests passing with 0 failures, 9.0 million fuzzing runs with no crash or hang, every out-of-policy network destination blocked, and a median 638 ms checkpoint and 520 ms rewind. It also says plainly where kosa8 doesn't lead yet, like sandbox creation time and third-party attestation. Read it at kosa8.com/research
Every feature is free for 14 days with no card or account. We'd love your feedback: which internal agents would your security team want sealed first?
@dhruvit18 congrats for ship.. qq can custom MCP tool servers be easily plugged into the policy gateway without rewriting our existing integrations?
Security shouldn't be an afterthought when deploying AI agents. It needs to be built into the infrastructure itself.
@jesv Human oversight: signed, two-person approvals
@Justin Jincaid Kosa8 comparison with all checklists