QuantmLayer Locks Down AI Coding Agents with Kernel-Level Sandboxing
QuantmLayer sandboxes AI coding agents with kernel-level containment (BPF-LSM, seccomp, cgroups), blocking attacks default Docker can't stop.
QuantmLayer is a new open-source runtime that secures what autonomous coding agents are allowed to do, rather than trusting what they say. Instead of running an agent with raw shell privileges, it wraps it in a containment cell built from Linux kernel primitives — BPF-LSM, seccomp, cgroups, and AppArmor.
The `ql` CLI ships curated profiles for popular agents like Claude, Codex, Gemini, Aider, and Cursor, plus a "learn" mode that observes an agent's real behavior and auto-generates a least-privilege policy. It can also wrap MCP servers — third-party code that MCP clients normally run with full local privileges — inside the same containment cell, with an optional inspection gateway that validates every tool call against its schema before it reaches the server.
The project publishes reproducible benchmarks comparing no containment, default Docker, and QuantmLayer across six real attacks: SSH key theft, secret exfiltration, fork bombs, ptrace-based memory reads, cloud-metadata SSRF, and unauthorized binary execution. Default Docker stops only the two filesystem-based attacks, while QuantmLayer blocks all six — including content-addressed execution, hashing every binary at execve so payloads dropped via prompt injection can never run. For engineers deploying autonomous agents, this shifts the trust boundary from what the LLM promises to what the kernel permits.