AgentSilo runs your AI coding agents in disposable, containerized silos — isolated desktop, isolated identity, policy-controlled network egress. A compromise inside a silo stays inside a silo.
An actively tested implementation, not a proof of concept — and deliberately honest about what it does and does not protect against.
Each agent gets its own rootless container, unprivileged host identity, browser profile, and work directory. Destroy it and it's gone.
All traffic forced through an identity relay and CONNECT proxy. Allow-by-default or approval-required, per silo. Every decision audited.
Create, start, attach, recover, restart, purge. A desktop operator UI with noVNC viewer and direct terminal attach to the agent.
Nothing inside a silo reaches your machine directly — and nowhere outside it without permission. The path down and out is deliberately narrow at every step.
Each silo is a disposable rootless container with its own Chromium desktop, work directory, and agent home. The Windows runtime is in progress — silos currently run on the Ubuntu host.