Visdom
Security

Contain AI coding agents, harden what they ship. A sandbox for autonomous agents paired with continuous application security scanning.

Part of Visdom · VirtusLab's AI-Native SDLC

Autonomous agents change the threat model

More code, generated faster, by actors that follow instructions literally.

01Prompt Injection

An agent reads a README and obeys it. A malicious dependency becomes an instruction channel.

02Credential Exfiltration

Tokens in env vars end up in logs, network requests, or a helpful commit message.

03Supply Chain Drift

AI reaches for the first package that compiles. Typosquats and malicious transitives slip in.

04Vulnerable by Default

SQLi, XSS, path traversal — classic bugs reappear at the speed of AI code generation.

Evidence log

The evidence, not the vibes

Why this matters, measured. Every number below links to the source.

Two layers, one problem

Contain the agent while it writes the code. Scan what it produces before anyone deploys it.

Runtime Containment

Sandcat

A Docker & dev container setup from VirtusLab for running AI agents in --dangerous mode safely. Every network call is routed through a transparent mitmproxy with allow/deny rules and secret injection at the proxy level.

Open source · VirtusLab

Application Security

Continuous AppSec Scanning

Static analysis, dependency scanning, secrets detection, IaC and container checks, DAST, and runtime protection — unified and noise-reduced so findings match what the agent actually changed.

Partner capability · Aikido

Sandcat · VirtusLab

A bulletproof cage for your agents

Sandcat runs AI coding agents inside a Docker sandbox and routes all container traffic — HTTP, HTTPS, DNS, arbitrary TCP/UDP — through a transparent mitmproxy over WireGuard. No per-tool proxy configuration. No tool can bypass the network boundary.

An allow/deny engine decides which destinations the agent can reach. Real secrets never enter the container. Environment variables hold placeholders like SANDCAT_PLACEHOLDER_GITHUB_TOKEN; mitmproxy substitutes the real value only for outbound requests to allowlisted hosts — anything else is blocked with HTTP 403.

WireGuard lives in a dedicated network container with NET_ADMIN. App containers share its network namespace and inherit the firewall rules, but cannot modify them. A compromised agent can neither read the secrets nor escape the tunnel.

Works as a dev container or standalone. Production-validated on Java and Scala projects with Claude Code — the first fully sandboxed, autonomously-authored PRs are already merged into VirtusLab OSS.

View on GitHub →

agent → github.comallow
agent → registry.npmjs.orgallow
agent → paste.ee / unknowndeny
SANDCAT_PLACEHOLDER_…substitute
placeholder → non-allowed host403
dns *.evil.xyzdeny
tcp/udp *deny
Partner Capability

Code-to-runtime AppSec, unified

Visdom Security complements Sandcat with a code-to-runtime security capability. The partner platform we integrate with — Aikido — brings every core AppSec scanner under one roof, deduplicates findings, and correlates them with reachability so teams act on what actually matters.

SAST

Static analysis

Scans source for SQLi, XSS, buffer overflows and custom rules — before code merges.

SCA

Open-source & supply chain

Flags vulnerable and malicious packages, including transitive dependencies and license risks.

DAST

Dynamic & API testing

Authenticated scans against running apps and APIs to surface runtime vulnerabilities.

SECRETS

Leaked credentials

Detects API keys, tokens, certificates and encryption keys exposed in the repository.

IaC / CSPM

Infra & cloud posture

Misconfigurations across Terraform, Kubernetes, container images and major cloud providers.

TRIAGE

Noise reduction

Reachability analysis and context correlation across scanners cut alert volume dramatically.

Aikido is a third-party partner. Logo and product names are trademarks of their respective owners. Visdom Security focuses on the capability; the vendor is pluggable.

Compare

Why this combo?

Good tools exist on both sides. Visdom Security is the glue — runtime containment with a mitmproxy-enforced network boundary, plus scanning that pays attention to what the agent actually changed.

Containment

Sandcat vs the alternatives

  • Docker Sandboxes (GA Mar 2026) — per-agent microVM. Great isolation, but no transparent proxy / secret substitution.
  • Claude Code native sandbox — OS-level FS & network rules, vendor-specific.
  • Plain devcontainers — cheap, but no enforced egress policy or secret hygiene.
  • Sandcat — transparent mitmproxy over WireGuard, placeholder-based secret injection, works with any tool that runs in a container.
AppSec scanning

Aikido vs the alternatives

  • Snyk — strongest vuln DB; no native DAST / CSPM / runtime; per-product pricing.
  • Semgrep — fastest SAST, great rule authoring; no SCA / DAST / cloud.
  • GitHub Advanced Security — zero-config if you already live in GitHub; narrower surface.
  • Aikido — SAST + SCA + DAST + Secrets + IaC + CSPM + runtime under one roof, with reachability-based triage.

Vendor is pluggable. The capability — code-to-runtime scanning with noise reduction — is the requirement.

FAQ

Ship fast.
Stay contained.

Let agents move quickly inside Sandcat. Let Aikido-grade scanning decide what reaches production.