# DevBox: an agent harness that keeps real secrets out of the sandbox

> DevBox is an open-source agent harness whose sandboxes never hold real credentials, because an egress proxy swaps them in as requests leave.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Tool
- **Published by:** RudderStack
- **Disclosed:** 2026-10-27
- **Affects:** AI coding agents, GitHub
- **Research by:** Fotis Xenikoudakis
- **Primary source:** https://www.rudderstack.com/blog/open-sourcing-devbox/
- **Page:** https://theinjection.dev/items/rudderstack-devbox-agent-sandbox/

DevBox is an open-source coding agent harness from RudderStack whose per-task sandboxes hold only placeholder credentials, with an egress proxy substituting the real values as requests leave.

## What happened

RudderStack open-sourced DevBox on October 27, 2026 under the MIT license, in a launch post by principal engineer Fotis Xenikoudakis. DevBox takes a ticket, works out which repositories need changes, edits the code, runs tests, reviews its own diff and opens a draft pull request. RudderStack says the harness has run on its own engineering work since April 2026.

## How it works

Each task runs in its own sandbox that receives dummy values for the GitHub token and the model API key. An egress proxy named iron-proxy is the sandbox's only route out and its only name resolver, and it substitutes the real credentials as requests leave while refusing hosts that are not on the allowlist. Write access is limited to listed repositories, and out-of-scope writes are refused at the proxy rather than discouraged in the prompt. Only designated organizations and users can steer the agent through pull request comments, and that trust list is empty by default.

## Who is affected

Teams that want to run coding agents on their own infrastructure are the audience, with tasks arriving from a CLI or Linear and changes landing on GitHub. DevBox needs Docker, Bun and an OpenAI or Anthropic API key, and RudderStack recommends Kubernetes with one pod per task for production, optionally running sandboxes as Kata Containers virtual machines. RudderStack lists GitHub-only support, with no GitLab or Bitbucket, and no stable extension interface yet.

## What to do

Read the launch post's five security properties before adopting DevBox, and leave the pull request trust list empty until the set of people allowed to steer the agent is settled. Prefer the Kubernetes deployment with network-policy egress for team use, because RudderStack presents Docker Compose as a laptop trial rather than a team setup.

## Quick facts

- **License:** MIT
- **Secrets:** Sandboxes get dummy tokens; iron-proxy substitutes the real values on egress
- **Isolation:** One sandbox per task, optionally as Kata Containers virtual machines
- **Write scope:** Limited to listed repositories, refused at the proxy
- **Reported use:** Over 1,500 pull requests since April 2026, with an 80% merge rate counted over pull requests merged or closed, per RudderStack
- **Built by:** RudderStack

## Sources

1. [Launch Post](https://www.rudderstack.com/blog/open-sourcing-devbox/)
2. [DevBox Repository](https://github.com/rudderlabs/devbox)