⏰ This product is scheduled for October 20th, 2026 12:01 AM PDT.

Upvoting is disabled until the launch is live.

kosa8

The Zero-Trust Infrastructure for Autonomous AI Agents.

2 followers

The Zero-Trust Infrastructure for Autonomous AI Agents.

2 followers

Visit website

Command line tools

•

AI Infrastructure Tools

kosa8 gives every AI agent its own sealed microVM on your Mac or Linux box. The network stays closed unless you allow a host, risky actions wait for a human, and every action is hash-chained. Checkpoint it, rewind in about a second, or fork it ×8.

Free Options

Launch tags:Developer Tools•Artificial Intelligence•Security

Launch Team

Maker

📌

Hey Product Hunt 👋 I'm Drew, and I built kosa8. AI agents now run with your keys, your data and a shell. We've all seen the headlines: an agent wipes a production database, one poisoned web page hijacks a coding assistant, a "helpful" MCP server quietly copies everything. Containers share your kernel, so they aren't the wall you want around code nobody wrote. kosa8 gives every agent its own sealed machine — a real microVM that boots in about half a second: 🔒 Network closed by default. Name the hosts an agent may reach; everything else is refused, on the host and inside the VM. ✋ Risky actions wait for a person (or two). Enforced by the daemon, not the agent's good manners. ⏪ Checkpoint the whole machine, processes included, and rewind in about a second when the agent gets it wrong. 🌱 Fork a live machine ×8, try eight fixes at once, keep the one that works. 🧾 Every action hash-chained and marked human or agent. It speaks Docker (your docker CLI and Compose just work) and MCP, runs local models, and works fully offline. Install: curl -fsSL https://kosa8.com/install.sh | sh — 14 days, every feature, no card. To be upfront: after the trial it's paid; there's no permanent free tier. What would you hand an agent if you knew you could rewind it? I'm here all day for questions.

Report

8d ago

Forum Threads

p/kosa8

•

6d ago

Comparing two agent prompts fairly: how do you keep the starting state identical?

When you compare two prompts, two models or two agent configs, the result is only as fair as the starting environment. If attempt A ran on a machine that attempt B had already touched (a warm cache, a half-applied migration, a leftover temp file), you're measuring the mess, not the agent.

What we do: build one base sandbox with the project and its dependencies ready, take a snapshot, and fork it so every variant starts from exactly the same running machine. Then each variant runs, gets scored, and the losers are thrown away. kosa8 can fork a live sandbox into several independent copies (about half a second per clone on an Apple M-series Mac in our benchmark harness).

p/kosa8

•

7d ago

A 6-point checklist for letting coding agents work unsupervised. What's missing?

While building kosa8 we kept coming back to the same short list of controls that make it reasonable to let Claude Code, Codex or Cursor run without someone watching every command:

One VM per agent, not a shared container. Containers share the host kernel; code an LLM wrote a minute ago is untrusted by definition.
Network closed by default. Allow-list the model API and your package registries, enforced outside the VM so root inside can't lift it.
No long-lived credentials in reach. If ~/.aws or a .env is mounted, the agent has it.
Undo for the whole machine. Checkpoint before the risky step and rewind afterwards, processes and all.
Sandbox the tools too. Every MCP server is code running with your permissions.
A log you can verify. What did the agent actually run, and can you prove nobody edited the record?

Which of these do you actually do today, and what would you add? Honest answers welcome, including "none of them".

p/kosa8

•

7d ago

What would you let an AI agent do if you could rewind it?

Hey everyone, I'm Drew, building kosa8. We launch here on Tuesday 20 October.

The question behind it: AI coding agents now run with your keys, your data and a shell. Most of us either babysit them or give them less to do than they could handle, because one wrong command or one poisoned web page is all it takes.

View all

Forum Threads

p/kosa8

•

6d ago

Comparing two agent prompts fairly: how do you keep the starting state identical?

p/kosa8

•

7d ago

A 6-point checklist for letting coding agents work unsupervised. What's missing?

While building kosa8 we kept coming back to the same short list of controls that make it reasonable to let Claude Code, Codex or Cursor run without someone watching every command:

One VM per agent, not a shared container. Containers share the host kernel; code an LLM wrote a minute ago is untrusted by definition.
Network closed by default. Allow-list the model API and your package registries, enforced outside the VM so root inside can't lift it.
No long-lived credentials in reach. If ~/.aws or a .env is mounted, the agent has it.
Undo for the whole machine. Checkpoint before the risky step and rewind afterwards, processes and all.
Sandbox the tools too. Every MCP server is code running with your permissions.
A log you can verify. What did the agent actually run, and can you prove nobody edited the record?

Which of these do you actually do today, and what would you add? Honest answers welcome, including "none of them".

p/kosa8

•

7d ago

What would you let an AI agent do if you could rewind it?

Hey everyone, I'm Drew, building kosa8. We launch here on Tuesday 20 October.

View all