Claude Code

Onyx Okay, this is one of those releases that feels immediately legible. If you’ve ever let Claude Code run a little too freely and then spent ten minutes wondering what it could touch, this is the boring answer in the best way.

Echo Yeah, and boring is doing real work there. Hazmat is basically saying: the agent can edit your repo, but it does not get your whole machine as the default world, which is the part people keep hand-waving past.

Onyx How’s your week been, by the way. I feel like I’ve been reading containment docs with my coffee-adjacent brain, which is an extremely normal sentence for episode eight ninety-one of Exploring Next.

Echo Mm-hm.

Onyx The user story is pretty clear to me. You want the productive version of Claude Code, or Codex, or whatever loop you’re running, but with fewer approval interruptions and a smaller blast radius if it goes weird.

Echo Right, and the interesting part is they make the session contract visible first. So before anything launches, you see what’s writable, what’s read-only, what network access exists, and what service access is basically off the table.

Onyx That’s the part I like. It’s not pretending the agent is magically safe, it’s making the boundary readable enough that a person can actually decide whether to trust the run.

Echo Exactly. Under the hood it’s OS-level containment, not just a polite prompt or a soft sandbox. They run the agent as a separate user, use seatbelt policy for filesystem scope, and add pf rules plus DNS blocks to choke off the obvious exfil paths.

Onyx Right, and the first-run experience sounds very product-y in a good way. You install it with Homebrew, do a dry run, bootstrap the harness, then launch Claude or Codex or OpenCode from the same shape of command.

Echo And the set of supported harnesses is not tiny. Claude Code, Codex, OpenCode, Antigravity, Hermes, Qwen Code, Cursor Agent, Pi, and even a custom loop through hazmat exec. That’s the real adoption bet: don’t make people change their agent habit, just wrap the habit.

Onyx Yeah, that’s the move. If I have to re-train my whole workflow, I get annoyed fast. If the thing keeps my existing loop and gives me a contract plus rollback, I’m paying attention.

Echo The recovery side matters more than people like admitting. They snapshot before launch, then you can diff and restore after the session, which means the failure mode becomes inspectable instead of mystical. That’s where these tools either earn trust or don’t.

Onyx It also fits a very specific user. Not someone poking at a demo, but someone running long tasks, broad permissions, maybe some low-supervision automation, and wanting repo writes without handing over their real login account.

Echo Mm-hm.

Onyx And they’re pretty explicit that prompts aren’t enough. Which, yeah, that’s such an Exploring Next sentence, but it’s also right. If a process can read secrets or modify global state, a bad instruction can spend that authority for you.

Echo That’s the mechanistic core. Approval prompts are workflow controls, not an authority boundary. Once the process already has the ability to read a token or call out over the network, the model doesn’t need to be clever to cause trouble. It just needs to be instructed badly enough.

Onyx The article even leans on concrete history there, which I appreciate. It’s not trying to sell you a vibe, it’s saying this class of failure has already shown up in real agent behavior and in known CVEs.

Echo Sure, and that’s why the containment story is more honest than the usual ‘make the model careful’ pitch. Hazmat lowers the process authority boundary. It doesn’t solve malicious dependencies, prompt injection, or a poisoned repo by itself, but it changes what those inputs can actually reach.

Onyx That’s the part I think gets adoption. People will tolerate a lot if the setup is understandable and the blast radius is visibly smaller. They will not tolerate a security story that feels like a mood board.

Echo No way.

Onyx Also, tiny note, the README proof path is weirdly satisfying. Preview setup, preview a session, write one contained file, fail one secret read, then inspect the diff. That’s the kind of proof that makes a tool feel real instead of ceremonial.

Echo Yeah, and the current status section is refreshingly plain. macOS native containment is the default supported path, current-user seatbelt launch is still experimental, Linux native is only plan-level, and Docker support is selective rather than pretending to be universal.

Onyx So the honest read is: this is already useful for a pretty large slice of agent-heavy macOS workflows, but it is not the whole world. Which, frankly, is better than shipping a giant platform-shaped promise nobody can actually run.

Echo I’m with you there. The clever bit is not the branding around Hazmat, it’s that the security boundary is tied to an operational path people can inspect. The questionable bit is just the usual one: containment is only as good as the places you still let the process reach.

Onyx Yeah. But if I’m choosing between ‘cross your fingers’ and ‘here’s the contract, here’s the snapshot, here’s the rollback,’ I know which one feels shippable. Come on, Echo, even you sound a little optimistic there.

Echo Don’t get used to it. But yeah, this one earns it.

Onyx Alright, I’m going to call that a rare win for the boring stuff. Which is deeply rude to the show, honestly.

Echo That is such an Exploring Next take.

Onyx Yeah, and somehow we’re still here. Talk tomorrow.