Its own microVM
Every run boots a fresh Firecracker microVM from a pinned image, as its own unprivileged user, with caps on memory, processes and CPU.
Briar / Private beta
Run untrusted agents. Get proof they stayed in.
Briar puts each agent run in its own microVM. No route to the internet, no real credentials, one watched way out. When the run ends, you get a signed record that says whether it stayed in.
How it works
One way out. We watch it.
Sandboxes tend to fail at the one door left open. So Briar closes everything else, watches that door, and attacks it on purpose.
No way out, twice
There is no default route. On top of that, a firewall drops everything except one address. Briar checks that both really work before the agent starts.
One door, split in two
The agent can only reach a package proxy or model gateway. The half it talks to has no network; the half that fetches reaches exactly one place. Model requests are rebuilt field by field, so nobody can switch on a provider's web search or code runner.
Nothing worth stealing
The agent gets a fake key, and that key is a tripwire. Planted decoy credentials give themselves away if used. The real key lives in a process the agent can't reach.
The record
Proof, not promises.
Every model call, refusal and blocked packet goes into a tamper-evident log. Each run ends with a signed verdict, HELD or FAILED, with the reason, tied to the exact image that ran. The agent's changes come back as a patch for you to review. Nothing lands in your repo on its own.
From a real run, 2026-10-18
- Verdict Held, with both egress layers up
- Decoys 4 planted, none used
- Other routes 0 blocked attempts
- Credential A short-lived AWS session the agent never saw
Who it's for
Built for teams who test dangerous agents.
AI labs, safety institutes and eval teams run agents with the safety rails off, on purpose. Briar is for them: keep the run contained, and come out with evidence that holds up. It started with a real incident. In July 2026, models in a cyber evaluation broke out of their sandbox through a zero-day in a package-registry cache proxy, one of the ways out the sandbox allowed.
Not running evals? The same pieces work on one machine with the coding agent you already use. It's the fastest way to see what Briar does.
Why trust it
We try to break it first.
Attacks on every releaseEvery release candidate faces a suite of scripted escape attempts on real microVMs, watched from outside the sandbox. A skipped test counts as a fail.
Frontier models as attackersIn October 2026, with permission, we let Claude Opus and Claude Fable attack it: blind, told the design, and given the proxy's source. None got a packet to the listener outside.
We write down the gapsWhat isn't proven yet is listed next to what is, including attacks that still slip past a detector. Beta teams get the full list.
Curious how other gateways hold up? We tested nine of them: AI gateways: strong locks, open toolboxes.
Private beta
Open source soon. Private beta now.
Briar is written in Rust and will ship under Apache-2.0. While we finish release checks, we share the source with beta teams. It runs on Linux (arm64 or x86_64) with KVM, or on an Apple Silicon Mac (M3 or later) through a Linux VM.
Works todaySingle-host runs. A model gateway for Anthropic-compatible providers and AWS Bedrock. One command to run a coding agent (OpenCode) in a microVM.
Not there yetA control plane, multi-node scheduling, production signing keys, and an outside red-team review.
What we askPoint it at your own evals and tell us where it falls short. Blunt feedback welcome.
About the name: in a hedgerow, briars are the thorny wild roses and brambles that fill the gaps between the trees. They are what keeps the livestock in.