# Trail of Bits publishes coop, a disposable VM layer for running Claude Code and Codex
Trail of Bits has published coop, a Rust command-line tool designed to run Claude Code and Codex inside disposable virtual machines instead of directly on a developer’s host machine. The GitHub repository describes the project as an isolated VM environment with full tool access, including Docker, git, compilers and package managers, but with the host insulated from whatever the agent does inside the guest.
That pitch reflects a growing concern around agentic coding tools: they are powerful enough to build, modify and execute real software, which also means they can touch a developer’s machine in ways that are hard to undo. Coop’s answer is to make the environment reproducible and easy to destroy. When the VM is done, the whole state can be thrown away and recreated for the next task.
The setup differs by platform. On Linux, coop installs Firecracker and fetches a guest kernel as part of its bootstrap flow. On macOS, the repository says users need Lima installed first, or setup will fail. The project is tested on macOS arm64 and Linux x86_64, while Linux arm64 builds exist but remain untested. Those details matter because the tool is not a generic container wrapper; it is built around backend-specific assumptions that shape how it can be deployed.
The repository also makes clear that the tool is meant for active project work, not just sandbox demos. Coop can start an instance for the current project and launch an agent CLI inside it, so the agent has access to the same kinds of commands a developer would normally use. The difference is that those commands run behind the boundaries of the VM rather than in the main workstation session.
For teams experimenting with coding agents, that could be a meaningful trade-off. A disposable VM is more expensive than a local shell session, but it provides a clear failure boundary. If an agent installs the wrong package, rewrites the wrong file or runs a risky command, the damage is confined to the guest. That is especially relevant when agents are allowed broad tool access and are expected to compile, test and interact with repositories on their own.
The project’s name is intentionally pronounced like "loop", not "co-op". That aside is minor, but it signals how deliberately the maintainers are framing the tool: this is infrastructure for one very specific use case, and the repository is trying to remove ambiguity about how it should be used.
Coop arrives at a moment when more developers are trying to balance speed with control. Agent tools can save time, but they also move more decisions onto the machine. By pushing those tools into short-lived virtual machines, Trail of Bits is offering a way to keep the convenience while shrinking the risk surface. Whether the approach becomes a standard pattern will depend on how much friction developers are willing to accept in exchange for isolation.
Event date: 2026-09-07
