How do I let an agent work on a repository I don't trust?

What a stranger's repository can do to an agent and its machine, and the trade-offs of read-only review, dev containers, VMs, hosted sandboxes and Golem's sandbox_run.

A repository from a pull request, an issue or a package you have never used is someone else's code and someone else's text. An agent working on it on your laptop has your credentials, your network and your other repositories within reach.

What a repository can do#

Run code when you build, install or test. Package install scripts, build scripts, test suites and Makefile targets all run with your permissions.
Configure the agent. A repository can carry .claude/settings.json (permissions and hooks, which run commands), .mcp.json (MCP servers), CLAUDE.md or AGENTS.md (instructions), and .cursor/ rules and hooks.
Talk to the agent. Any file the agent reads can carry instructions. See How do I tell if a coding agent was prompt-injected?

Git does not copy a repository's hooks when you clone it, so .git/hooks is not a risk on its own. What you run afterward is.

What the agents give you#

Claude Code asks whether you trust a folder the first time you start it there, and asks before it starts MCP servers from a project's .mcp.json. VS Code and its forks offer Restricted Mode for a folder you do not trust, which limits what runs automatically. Use these: they are the first line, and they are free. They decide whether the repository's configuration is honoured; they do not isolate the code once you run it.

Choosing where the work happens#

Option	Isolates	Costs you
Read only, no execution	Nothing runs, so nothing escapes	You cannot build or test; the agent can still be talked into a later action
Dev container	Files and processes, inside a container on your machine	Credentials and the Docker socket must stay out; a container shares the host's kernel; network is open unless you close it
Virtual machine	A separate kernel and filesystem	Setup time and resources; you still choose what to copy in
Hosted sandbox	Someone else's machine	Your code leaves your machine; their terms apply

Anthropic publishes a reference dev container for Claude Code with a firewall that limits outbound traffic, and suggests a setup like it for running Claude Code without permission prompts. Whatever you choose, give the work no credentials it does not need and no network beyond what the task requires.

Where Golem fits#

A sandbox per task. Golem's sandbox_run tool hands a task and a local path or an https repo to a child agent in a fresh Linux VM on the same Mac:

no network by default, with named hosts opened by hosts, ports 80 and 443 only, and private addresses refused;
a read-only root, no capabilities, an unprivileged user, and no credentials: files go in read-only, Golem refuses to hand over your home directory or a credentials directory, and a repository is cloned inside;
a child agent fenced to the sandbox's own tools, capped at 200,000 tokens per task, and the VM discarded afterward.

It returns an answer, a patch for your agent to review before applying, and a deviations list of everything the child tried and was not allowed to do, such as egress_denied with the host and port. sandbox_browse and sandbox_open do the same for a web page and for files. The child's calls and its VM's network requests are signed into the same record as the session that handed the work over. See The sandbox.

Reading without running. /safely review restricts a Claude Code session to reading files plus single git status, log, diff, show, branch and remote commands and single gh pr, issue, repo, search and api commands, with no chaining, so the agent can review a pull request without building or running it. See Safely.

A repository nobody has worked in. Under Security Inventory → Settings, Repos no agent has worked in can be set to Alert on first use or Block, so a fresh clone gets a look before an agent works in it.

Lockdown after a risky read. A rule can lock a session's shell down after a web fetch or a likely injection: no network, no credentials, writes only inside the repository. See Lockdown.

What Golem does not do#

The sandbox needs a Mac with Apple silicon, macOS 26 or later, and Claude Code installed, because the child agent is a Claude Code session. Elsewhere its tools report that it is unavailable.
Isolation does not detect anything. It limits what hostile content can reach, and reports what was tried.
The returned patch is the stranger's influence carried back. Your agent, and you, review it before it is applied.
A sandbox_run command runs for 2 minutes by default and 10 at most, and a task for 10 minutes by default and 30 at most. Long builds do not fit.