Chainguard 推出 Workspaces、Checks，並擴展 Libraries 防護以保障 AI 編碼智能體

An AI coding agent can write a useful fix and still create a security incident along the way. It may install a compromised dependency, follow instructions embedded in untrusted content, or run a command with credentials that give it far more access than the task requires. As teams put more agents to work in parallel, securing the code they produce is only part of the problem.

Chainguard is addressing that broader exposure with three announcements at Assemble London: Workspaces, isolated environments for developers and coding agents; Checks, a verification engine designed to run inside the agent development loop; and expanded Libraries protections covering additional programming languages and vulnerability remediation.

The launches connect three questions enterprises increasingly have to answer: where an agent executes, how its work is verified, and which external software it can bring into the organization. Workspaces and Checks are launching in beta, while the new Go and .NET Libraries offerings are entering Early Access.

Putting a Boundary Around Each Coding Agent

Chainguard Workspaces gives each developer and agent a separate remote microVM. The environment synchronizes the developer’s local working tree, allowing them to retain their editor and Git workflow while execution happens away from their machine. Separate environments also let multiple agents attempt changes in parallel without sharing the same working environment.

The distinction matters because an agent’s useful capabilities—running commands, installing packages, and accessing services—are also potential routes for compromise. A policy written in an agent’s instructions depends on the agent following it. A boundary enforced by the execution environment can restrict what happens even when the model makes a bad decision.

According to the release, real credentials are injected outside the workspace. Tools that require a credential on disk receive an encrypted, short-lived substitute. Optional egress policies restrict outbound connections to approved destinations, reducing the ability of a compromised dependency or prompt-injected agent to send data elsewhere.

These controls address different risks. Hardware isolation separates workloads; credential mediation keeps reusable secrets out of the agent’s reach; and network policy constrains where it can communicate. Their effectiveness still depends on the permissions and destinations an organization approves. Isolation does not make every authorized action harmless.

The environments use Chainguard OS Packages and verify dependencies against the lockfile at runtime. Chainguard’s existing OS Packages offering supplies continuously maintained packages, builds them from source, and includes software bills of materials. That background explains the company’s approach: extend its controlled software foundation into the place where agents execute.

Workspaces also generates signed records covering the environment, code changes, and check results. For security teams, that provides a way to investigate what an agent did rather than relying solely on its own summary of the session.

Moving Verification Into the Agent’s Working Loop

Code generation can be fast while the path to verified code remains slow. An agent makes a change, submits it to continuous integration, waits for a runner to set up, then receives a failure after its working context has moved on. Repeating that process across many agents can increase queues and duplicate setup work.

Chainguard Checks moves verification into that loop as a tool call. Paired with Workspaces, the agent session suspends while checks run, then resumes with structured failure logs in its context. The intended workflow is iterative: make a change, run checks, inspect the failure, and try again before handing off the result.

Warm snapshots contain preinstalled dependencies and are rebuilt when the lockfile changes. Each workflow step runs in its own hardware-isolated microVM. The release also describes host-side injection of short-lived credentials into outbound requests and declarative policies for network access.

A passing run produces a signed attestation linking the environment, test result, and commit. Downstream merge gates can verify that evidence and accept the result without repeating the same suite, according to Chainguard.

That is a useful distinction between transporting evidence and merely transporting an agent’s claim that tests passed. An attestation can establish which checks ran against which commit in which environment. It cannot establish that the tests covered every important behavior, or that a passing change meets every security requirement. Teams still need suitable tests, trusted verification policies, and review where judgment matters.

Chainguard says the design returns results in seconds and reduces redundant compute. The launch materials do not provide an independently validated benchmark establishing a universal speed or cost improvement across repositories.

Securing the Dependencies Agents Pull In

The third announcement expands Chainguard Libraries, its managed catalog and endpoints for open source language dependencies. The existing service is designed to fit artifact managers and development workflows, with provenance and signed software bills of materials for Chainguard-built packages.

The new Go endpoint includes malware and greyware scanning, configurable package policies, and CVE remediation. The .NET endpoint offers an alternative to direct NuGet consumption with scanning and policy controls. Both are entering Early Access.

Chainguard is also adding CVE remediation for JavaScript and Go, including backported fixes for critical- and high-severity vulnerabilities. Backporting matters when a team cannot immediately move to a newer major version without application changes or extensive testing. It can reduce exposure while the larger upgrade is planned.

For Java and Python, the company says Athena, its industry coalition, will supply remediated artifacts for vulnerabilities discovered by frontier AI models on the day those vulnerabilities become public. This is a claim about response at public disclosure, rather than a guarantee that undisclosed flaws cannot exist.

A Survey Shows Why Patching Alone Is Under Pressure

Alongside the products, Chainguard is releasing The AI Exploit Gap, a survey commissioned from Wakefield Research. It collected responses in September 2026 from 1,300 cybersecurity leaders across nine markets. Respondents were at least director-level and generally worked at organizations with at least 500 employees, with a 250-employee minimum in Singapore and UAE/Saudi Arabia.

In that survey, 54% said their organizations knowingly leave high or critical vulnerabilities unpatched at least sometimes, and 93% expressed concern about remediating AI-driven exploits quickly enough. Some 76% reported a confirmed or suspected AI-driven attack during the previous year.

The last figure combines confirmed incidents with suspicion. It should not be read as an independently verified measure of attacks caused by AI. More broadly, these are respondents’ reports and expectations, not telemetry establishing how frequently a particular attack technique succeeds.

The operational findings are revealing. Among companies with at least $1 billion in revenue, 66% reported leaving high or critical vulnerabilities unpatched at least sometimes, compared with 27% among companies below $250 million. Larger organizations cited business tradeoffs such as disruption and competing product priorities. The gap is therefore about the ability to deploy changes as well as the ability to discover flaws.

More Autonomy Requires More Verifiable Control

Chainguard’s three launches form a coherent approach: constrain the execution environment, give agents rapid and attributable verification, and govern the dependencies they consume. Each addresses a different part of the same development workflow.

The practical test will be whether those controls fit real repositories, service integrations, and release policies without becoming another bottleneck. Beta and Early Access status leave that work ahead. The direction is clear, however: as coding agents gain the ability to act, enterprises need security controls that remain enforceable and inspectable throughout the work.