Trail of Bits releases Coop, a Rust CLI that runs Claude Code and Codex in disposable VMs

What Coop is

Coop is a new command-line tool from the security firm Trail of Bits that runs AI coding agents inside disposable virtual machines. According to the project's GitHub README, which surfaced on the front page of Hacker News, the Rust-based CLI manages isolated VMs where Claude Code and Codex are given full tool access — Docker, git, compilers and package managers — while keeping the host machine out of harm's way. Each VM is designed to be isolated, reproducible and inexpensive to create and destroy.

One naming note from the documentation: it is pronounced like the structure that houses chickens, rhyming with "loop," and not like "co-op."

Setup and platform support

There are two installation paths. The quickest is a shell script fetched from the repository and piped to bash; alternatively, developers can build from source with Cargo and copy the resulting binary into place.

After installation, a setup step builds the VM template image, and the behavior differs by platform. On Linux, setup installs Firecracker and downloads a guest kernel. On macOS, the tool depends on Lima, which must be installed beforehand via Homebrew — the README warns that setup fails without it.

Platform support is explicit: coop is tested on macOS arm64 (Apple Silicon) and Linux x86_64. Builds for Linux arm64 exist, but the project says they are untested. Keeping the tool itself current is handled through a dedicated update command and an updates configuration section.

Everyday workflow

Using coop is deliberately simple. A developer changes into their project directory, runs coop up to start an instance for that project, and then launches an agent CLI with either coop claude or coop codex. From that point the agent operates inside the VM, free to install dependencies, run builds and use Docker, with the results discarded along with the machine when the session ends.

The documentation set goes well beyond a basic README, covering the command and configuration references, images and profiles, workspace syncing between host and guest, dedicated integration guides for Claude Code and Codex, editor integration, multi-instance setups, platform backends, shell completion, an architecture and trust model page, and a contributing and security policy.

Why it matters

Agent CLIs no longer just suggest code; they execute shell commands, install packages and rewrite files using the permissions of whoever launched them. When an agent misreads an instruction or runs a destructive command, the damage lands directly on the developer's real machine — files get deleted, configs get mangled, and dependencies accumulate on the host.

Coop takes the opposite approach to restricting agents: rather than limiting what the tools can do, it gives them a fully equipped but throwaway environment. The host stays clean, and risky experiments cost nothing because the VM is simply destroyed afterward. Running the agent inside a virtual machine also provides a much harder boundary than a terminal session on the host itself.

That a well-established security company like Trail of Bits built this, and published a trust-model document alongside it, signals how seriously the industry is treating the safety gap around agentic coding tools. As Claude Code, Codex and similar agents become default parts of the development workflow, expect isolation tooling like this to move from nice-to-have to standard practice.