Chainguard is launching four software development products featuring AI agents. Workspaces provides each coding agent with its own isolated microVM, Checks brings CI into the agent loop, and Harness uses Claude Mythos to detect vulnerabilities. In addition, Chainguard Libraries now supports Go and .NET.
These days, coding agents run migrations, remediation campaigns, and refactoring tasks for hours on end. They typically have the same permissions as the developer who launches them and are located right next to credentials, cloud keys, and production systems. Permission prompts and allowlists are meant to keep this in check. But they only work if the agent follows the rules. And anyone running a dozen agents at once spends most of their time clicking “allow.”
Chainguard Workspaces eliminates that trade-off. Every developer and every agent gets their own hardened microVM with no access to sensitive credentials. Optional egress policies block connections that a team hasn’t approved. “very agent gets its own hardened, isolated machine with nothing in it worth stealing, so you can let it run for hours and trust what comes out the other end,” says CEO Dan Lorenc.
The microVMs run remotely and sync the local working tree, letting developers keep their editor and Git workflow. Dozens of agents can work in parallel without interfering with one another. Security teams can see what an agent has read, executed, and accessed. Everything is recorded in a signed report.
CI as a tool call
In addition, the company is introducing Chainguard Checks. Agents iterate continuously, so every change ends up in the same CI queue. By the time the results come back, the agent has lost its context. Checks turn CI into a tool call that runs identically everywhere. With Workspaces, an agent session pauses during checks and resumes within seconds, with structured error logs in context. Each successful run produces a signed attestation, so merge gates don’t need to rerun the test suite.
Mythos searches for vulnerabilities
Chainguard Harness builds an application from the source code within an isolated microVM and has a frontier model, such as Anthropic’s Claude Mythos 5.1, attack the running instance. The team reports only findings that are consistently reproducible, along with a fix reviewed by staff. Harness is available for purchase via the Claude Marketplace. An interesting detail: customers do not need access to the model themselves.
Finally, Chainguard Libraries, previously available for Java, is expanding to Go and .NET. For JavaScript and Go, CVE remediation is provided via backports of fixes for critical and severe vulnerabilities. Through Athena’s crowdsourced threat intelligence, customers also receive zero-day patches on the day of publication.
Tip: Chainguard introduces a secure catalog for agent skills