---
type: "post"
id: "phosphor-coding-agent-v0-7-0-adds-kernel-048069"
slug: "phosphor-coding-agent-v0-7-0-adds-kernel-048069"
title: "Phosphor coding agent v0.7.0 adds kernel-enforced OS sandboxing on Linux, macOS and Windows"
description: "Phosphor v0.7.0 adds kernel-enforced sandboxes for agent-run bash commands and MCP stdio servers on Linux, macOS, and Windows."
retrieval_nugget: "Phosphor v0.7.0 adds kernel-enforced sandboxes for agent-run bash commands and MCP stdio servers on Linux, macOS, and Windows. The release matters to teams assessing coding-agent security because it layers operating-system controls, resource caps, and user-gated escalation beneath the agent’s tool interface."
published_at: "2026-11-01"
updated_at: "2026-11-01"
record_date: "2026-11-01"
date_kind: "published_at"
topics: ["mcp","agent-security","coding-agents"]
entities: ["Phosphor","MCP"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Phosphor v0.7.0 adds kernel-enforced sandboxing for agent commands across Linux, macOS and Windows, extending prior coverage of agent sandboxing and Codex's Windows sandbox."
prior_refs: ["memory:e6ed8e7c-4362-883d-a751-6ca33a2b9cf5","memory:a564ba60-25e5-8d54-aa14-8c482732b5cb","memory:92ddb7b7-f0f4-82e1-a72f-52f2a8c5d973","memory:ce5d0d5c-9645-827f-a4ff-8d314184270a"]
source_url: "https://github.com/hackafterdark/phosphor/releases/tag/v0.7.0"
source_urls: ["https://github.com/hackafterdark/phosphor/releases/tag/v0.7.0"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:phosphor-coding-agent-v0-7-0-adds-kernel-048069"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/phosphor-coding-agent-v0-7-0-adds-kernel-048069/","markdown":"https://newruntime.com/posts/phosphor-coding-agent-v0-7-0-adds-kernel-048069.md","json":"https://newruntime.com/posts/phosphor-coding-agent-v0-7-0-adds-kernel-048069.json"}
---

# Phosphor coding agent v0.7.0 adds kernel-enforced OS sandboxing on Linux, macOS and Windows

## Retrieval answer

Phosphor v0.7.0 adds kernel-enforced sandboxes for agent-run bash commands and MCP stdio servers on Linux, macOS, and Windows. The release matters to teams assessing coding-agent security because it layers operating-system controls, resource caps, and user-gated escalation beneath the agent’s tool interface.

## Summary
Phosphor v0.7.0 adds kernel-enforced sandboxes for agent-run bash commands and MCP stdio servers on Linux, macOS, and Windows. The release matters to teams assessing coding-agent security because it layers operating-system controls, resource caps, and user-gated escalation beneath the agent’s tool interface.

## What happened
Phosphor’s November 1, 2026 release says that its bash tool and MCP stdio servers now run inside kernel-enforced sandboxes rather than relying only on tool-layer path checks. The implementation differs by operating system: Linux uses seccomp filtering for child processes; macOS uses Seatbelt profiles with resource caps based on rlimits; and Windows uses restricted tokens and Job Objects, with an AppContainer tier for confined children. The release also mentions Windows capability probing and container ACE grants that are revoked at shutdown.

Kernel resource limits—including CPU, memory, and file size—apply to sandboxed bash and MCP child processes across all three platforms. Phosphor adds a ProxyOnly network tier, which routes egress through a proxy. When a host is refused, the refusal message points to the configuration needed to allow it; the release says the refused host is logged, not the full URL.

The release describes a one-off pre-grant prompt for commands that legitimately need to leave the sandbox. It says these escalation prompts cannot be bypassed by YOLO mode, allowlists, or hook pre-approvals. YOLO pin and escalation pre-grants are available for recurring workflows. Sandbox mode and resource caps are floored against workspace overrides, so project settings cannot silently weaken them. Host binaries that could bypass the sandbox are denied while it is active, and nested shells are closed off on degraded hosts.

Other hardening changes include denying agent commands read access to well-known credential locations such as `.env` files, SSH keys, and service-account files. MCP stdio servers no longer inherit ambient credentials from their parent process. Workspace configuration files and `.git` are read-only to the agent, and sandbox mode defaults to workspace mode. The release also adds opt-in, cache-scoped trust for language toolchain caches, a `allow_commands` permission opt-in, and an OpenTelemetry endpoint probe, alongside fixes and documentation updates. It does not state a price or provide comparative security-test results.

## What the archive adds
[An earlier Field Note argues that agent security depends on runtime boundaries, not on a sandbox label or the task prompt](https://newruntime.com/posts/agent-sandboxes-have-become-a-critical-boundary-because-2df4bb/). Phosphor 0.7.0 is a new release on that known topic: it supplies a concrete cross-platform implementation for shell and MCP child processes, rather than evidence that all coding agents now use comparable controls.

## Trend signal
This supports the pattern that agent security is moving to runtime boundaries: the release describes OS enforcement, resource constraints, credential denial, and explicit escalation controls around execution. The evidence is one product release, so it illustrates the direction but does not establish adoption across the market. [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/).

## Why now
The release itself frames sandboxing as an addition to Phosphor’s command and MCP execution path, and documents the controls alongside security-hardening guidance. It gives no external event or deadline as the reason for the timing, so the significance here is the shipped implementation, not a claimed response to a broader incident.

## Why it matters
For teams building with coding agents, the release makes the boundary around command execution more explicit. Tool-level path checks can govern what an agent asks a tool to do, but OS enforcement, process restrictions, and resource limits address what child processes can do after launch. The release’s credential restrictions and removal of inherited ambient credentials also focus attention on what the process can read or use, not only on which command the model requested.

The escalation design is relevant to workflow owners: a legitimate exception can be granted, but the prompt is described as non-bypassable by several convenience mechanisms. That is a useful property to evaluate when designing approvals. Still, teams should treat Phosphor as one implementation to inspect, not as proof that a sandbox makes an agent safe. Its practical fit depends on platform behavior, configuration, and whether the controls match the organization’s threat model.

## Limits and uncertainty
The release is the project’s own description of v0.7.0; the supplied material includes no independent audit, adversarial test results, or performance measurements. It does not establish how the controls behave across every host configuration, how often degraded-host paths occur, or whether the platform-specific implementations provide equivalent protection. Nor does it give deployment counts, adoption data, pricing, or a comparison with other coding agents. The release details mechanisms and intended constraints, but teams still need to validate them against their own workloads and threat models.

## Skill to build now
Make a short execution-boundary checklist for your coding-agent stack this week. For each shell or MCP process, record its OS-level isolation mechanism, resource limits, network route, credential inheritance, writable files, and exception path. Compare those answers with the controls Phosphor documents, then test one legitimate request that needs an exception and confirm that approval is visible and cannot be silently bypassed in your configuration.

## Reader takeaway
Phosphor 0.7.0 is a concrete example of coding-agent security moving below the tool API: operating-system sandboxing, resource limits, credential restrictions, and explicit escalation are applied to shell and MCP child processes. It is worth studying as an implementation, while remembering that a release description is not an independent security validation.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Mcp](https://newruntime.com/topics/mcp.md): Explore the mcp topic hub.
- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- topic hub: [Coding Agents](https://newruntime.com/topics/coding-agents.md): Explore the coding-agents topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)