Theorem builds formally verified agent sandbox, proving at machine-code level guests can't touch host files
ChrSzegedy · x · 2026-11-04
Theorem Labs published Part 1 of its verified agent sandbox series: building on MIT's xv6iris (1.5M lines of Rocq proving kernel correctness down to compiled machine code), the team added a KVM-like hypervisor inside the xv6 kernel and a Firecracker-like vmm that runs untrusted guest code in a VM.
- They proved, down to machine code, that arbitrary guest code cannot modify host files
- The thesis: sandboxes must be as trustworthy as cryptographic primitives, which requires extending formal verification into real computer systems to secure internet infrastructure against agents and malicious actors
- Framed as a first step toward verifying production sandboxes, with more results promised soon
More from coding & agent
- Axion 1.0: ByteDance-Backed Open Agent Foundation Model With 3-Stage Recipe — Yuqi Jia · 2026-11-04
- Caper Pre-Executes Shell Commands in Sandboxes for Safer Agent Approvals — SingaporeManagementUniversity · 2026-11-04
- Claude Code lead: AI shifts team bottlenecks upstream to PMs and downstream to verification — Flomerboy · 2026-11-04
- 10 open-source repos that run AI agents while you sleep: cron, webhooks, cloud PRs — victor_explore · 2026-11-04
- The shopping cart pattern: recursively chaining AI micro-decisions to handle multi-intent queries — hardimanjames · 2026-11-04
- Researcher: Codex is 'miles ahead' of Claude Code on computer use — Yuchenj_UW · 2026-11-04