Softonic reported this week that OpenAI and Anthropic jointly disclosed a batch of AI agent hacks, and the liability question that follows is the real story. If a coding agent deletes a directory because a webpage told it to, someone has to answer for it. The right response from a desktop user is not to stop running agents. It is to run them behind guardrails. We tested 7 apps that filter agent inputs and outputs, sandbox their execution, and log what they did, so that when something goes wrong we can point at the exact prompt that caused it.
What to look for in an AI agent security app
Agent safety splits into three problems: what the agent reads, what the agent does, and what the agent leaves behind. Any real setup covers all three.
- Prompt-input filtering for prompt injection and PII
- Output validation against structural rules
- A sandbox for shell execution, so the agent cannot touch the wrong file
- Audit logs of every prompt, tool call, and response
- Integrates with the coding agents we already use (Claude Code, Cursor, Cline)
- Runs locally where possible, no third-party service seeing every prompt
Quick comparison
| App | Best for | Platforms | Free | Cost | Rating |
|---|---|---|---|---|---|
| Guardrails AI | Structural and content guardrails | Windows, macOS, Linux, Python | Yes | Free tier + paid Hub | 4.7 (GitHub) |
| NeMo Guardrails | Rule-based conversational safety | Windows, macOS, Linux | Yes | Free | 4.6 |
| Rebuff | Prompt-injection detection | Windows, macOS, Linux, cloud | Yes | Free tier | 4.5 |
| Docker Desktop | Container sandbox for agents | Windows, macOS, Linux | Yes | 9/user/mo Pro | 4.5 |
| gVisor | Kernel-level sandbox for containers | Linux, macOS Docker | Yes | Free | 4.4 |
| Firecracker | Micro-VMs for lightweight isolation | Linux | Yes | Free | 4.6 |
| LangKit | Runtime metrics for LLM prompts | Windows, macOS, Linux | Yes | Free | 4.5 |
1. Guardrails AI, best for structural and content guardrails
Guardrails AI is a Python library and Hub that wraps model calls in declarative rules. Say “the output must be valid JSON with these fields,” “the output must not contain PII,” “the output must not include a shell command,” and the library either rewrites, retries, or fails the call. The Hub adds a marketplace of pre-built validators.
Where it falls short: Python-centric, so it fits agent frameworks better than “I just want Cursor to behave” use cases.
Pricing:
- Free: core library, Apache 2.0
- Paid: Hub Pro tier for shared validators and hosted enforcement
Platforms: Windows, macOS, Linux, Python
Download: Guardrails AI | GitHub
Bottom line: the tool to reach for when we are writing our own agent and we want it to fail loudly on bad output.
2. NeMo Guardrails, best for rule-based conversational safety
NeMo Guardrails by NVIDIA lets us describe policies in a small domain-specific language, Colang, then wraps any LLM call. A policy might say “if the user asks about a system prompt, refuse,” or “always call the retrieval tool before answering domain questions.” Colang runs before, alongside, and after the model call.
Where it falls short: Colang is a language to learn, and the runtime adds latency.
Pricing:
- Free: open source, Apache 2.0
- Paid: none, though NeMo Enterprise services exist for the training stack
Platforms: Windows, macOS, Linux
Download: NeMo Guardrails
Bottom line: worth the learning curve if the agent is user-facing and policy rules should live outside the prompt.
3. Rebuff, best for prompt-injection detection
Rebuff is a small library dedicated to one problem: catching prompt injection before it reaches the model. It uses heuristics, a vector DB of known attack strings, and a canary token approach. Anything that looks like an injection is flagged, and the calling code decides what to do.
Where it falls short: heuristics have false positives, and the vector approach requires a running vector DB.
Pricing:
- Free: open source, MIT
- Paid: cloud tier with hosted vector DB and shared attack corpus
Platforms: Python, JavaScript, cloud
Download: Rebuff
Bottom line: the specialized tool. Bolt it on before the general-purpose guardrail library.
4. Docker Desktop, best for a familiar container sandbox
Docker Desktop is the least glamorous entry on the list and probably the most useful. Run coding agents inside a container with the repo mounted read-write and everything else read-only, and even a hostile prompt cannot rm the machine. Volumes make handoffs to the host explicit.
Where it falls short: the desktop app is heavy on RAM, and licensing has changed twice in three years.
Pricing:
- Free: Personal and small teams (fewer than 250 employees)
- Paid: 9/user/mo Pro, more for Team
Platforms: Windows, macOS, Linux
Download: Docker Desktop
Bottom line: the practical answer to “how do I let Claude run npm install without giving it my filesystem.”
5. gVisor, best for a kernel-level sandbox
gVisor is a userspace kernel written by Google. Containers running under gVisor can only make a subset of syscalls, so even a container escape does not reach the host kernel. It is heavier than a normal container but much lighter than a full VM.
Where it falls short: performance overhead is real, and not every workload runs under it without tweaking.
Pricing:
- Free: open source, Apache 2.0
- Paid: none
Platforms: Linux, and Linux-inside-Docker on macOS
Bottom line: the deeper isolation layer, for agents that touch code from strangers.
6. Firecracker, best for micro-VMs
Firecracker is a KVM-based hypervisor for micro-VMs. Boot times are under a second, memory footprint is measured in megabytes, and isolation is closer to a full VM than to a container. AWS Lambda runs on it. Locally, a Firecracker VM per agent run keeps every job’s blast radius contained.
Where it falls short: Linux only, and setup is not a five-minute exercise.
Pricing:
- Free: open source, Apache 2.0
- Paid: none
Platforms: Linux
Download: Firecracker | GitHub
Bottom line: the strongest local isolation option short of a full VM.
7. LangKit, best for runtime metrics and observability
LangKit by WhyLabs measures every prompt and response for text quality, toxicity, sentiment, similarity to known injections, and PII. It slots in front of any LLM call, and dashboards show anomalies over time. The point is not to block, it is to notice.
Where it falls short: observability alone does not stop an attack, it explains what happened after the fact.
Pricing:
- Free: open source, Apache 2.0
- Paid: WhyLabs platform for hosted dashboards, from about 200/mo
Platforms: Windows, macOS, Linux
Download: LangKit
Bottom line: the “what just happened” layer. Pair it with any of the enforcers above.
How to pick the right one
- For rewriting or refusing bad model output: Guardrails AI.
- For policy rules outside the prompt: NeMo Guardrails.
- For prompt-injection detection specifically: Rebuff.
- For sandboxing shell execution the pragmatic way: Docker Desktop.
- For deeper isolation on Linux: gVisor.
- For micro-VM isolation: Firecracker.
- For measuring what agents are doing: LangKit.
- For prompt-level audit logging: PromptLayer is worth a look, it captures every request and response with metadata.
A defensible desktop setup usually stacks three of these: a sandbox (Docker Desktop), a guardrail layer (Guardrails AI or NeMo), and observability (LangKit or PromptLayer).
FAQ
Do I really need to sandbox coding agents?
If the agent runs shell commands or writes files, yes. If it only chats, no. The line is whether a prompt injection can turn into an action.
Which of these is the easiest first step?
Docker Desktop with a locked-down container for the coding agent. Add Guardrails AI to the model call. That already blocks the majority of accidental damage.
Can these tools protect the model against Astra-style attacks?
Against direct model attacks, no. Nothing on this list changes model weights. Against prompt injection, PII leakage, and unsafe tool calls, yes.
Are the free tiers enough?
For a single developer, yes. Guardrails AI, NeMo Guardrails, Rebuff, gVisor, Firecracker, LangKit, and PromptLayer all have real free tiers. Only Docker Desktop starts charging beyond very small teams.
Do these slow the agent down?
Guardrails add latency, sometimes hundreds of milliseconds. Sandboxes add negligible latency for containers and a bit more for micro-VMs. Trade the latency for the safety, always.
