# How do I let an agent work on a repository I don't trust?

> What a stranger's repository can do to an agent and its machine, and the trade-offs of read-only review, dev containers, VMs, hosted sandboxes and Golem's sandbox_run.

A repository from a pull request, an issue or a package you have never used is someone else's code and someone else's text. An agent working on it on your laptop has your credentials, your network and your other repositories within reach.

## What a repository can do

- **Run code when you build, install or test.** Package install scripts, build scripts, test suites and `Makefile` targets all run with your permissions.
- **Configure the agent.** A repository can carry `.claude/settings.json` (permissions and hooks, which run commands), `.mcp.json` (MCP servers), `CLAUDE.md` or `AGENTS.md` (instructions), and `.cursor/` rules and hooks.
- **Talk to the agent.** Any file the agent reads can carry instructions. See [How do I tell if a coding agent was prompt-injected?](/guides/prompt-injection)

Git does not copy a repository's hooks when you clone it, so `.git/hooks` is not a risk on its own. What you run afterward is.

## What the agents give you

Claude Code asks whether you trust a folder the first time you start it there, and asks before it starts MCP servers from a project's `.mcp.json`. VS Code and its forks offer Restricted Mode for a folder you do not trust, which limits what runs automatically. Use these: they are the first line, and they are free. They decide whether the repository's configuration is honoured; they do not isolate the code once you run it.

## Choosing where the work happens

| Option | Isolates | Costs you |
|---|---|---|
| Read only, no execution | Nothing runs, so nothing escapes | You cannot build or test; the agent can still be talked into a later action |
| Dev container | Files and processes, inside a container on your machine | Credentials and the Docker socket must stay out; a container shares the host's kernel; network is open unless you close it |
| Virtual machine | A separate kernel and filesystem | Setup time and resources; you still choose what to copy in |
| Hosted sandbox | Someone else's machine | Your code leaves your machine; their terms apply |

Anthropic publishes a reference dev container for Claude Code with a firewall that limits outbound traffic, and suggests a setup like it for running Claude Code without permission prompts. Whatever you choose, give the work no credentials it does not need and no network beyond what the task requires.

## Where Golem fits

**A sandbox per task.** Golem's `sandbox_run` tool hands a task and a local `path` or an https `repo` to a child agent in a fresh Linux VM on the same Mac:

- no network by default, with named hosts opened by `hosts`, ports 80 and 443 only, and private addresses refused;
- a read-only root, no capabilities, an unprivileged user, and no credentials: files go in read-only, Golem refuses to hand over your home directory or a credentials directory, and a repository is cloned inside;
- a child agent fenced to the sandbox's own tools, capped at 200,000 tokens per task, and the VM discarded afterward.

It returns an answer, a patch for your agent to review before applying, and a `deviations` list of everything the child tried and was not allowed to do, such as `egress_denied` with the host and port. `sandbox_browse` and `sandbox_open` do the same for a web page and for files. The child's calls and its VM's network requests are signed into the same [record](/record) as the session that handed the work over. See [The sandbox](/shield#the-sandbox).

**Reading without running.** `/safely review` restricts a Claude Code session to reading files plus single `git status`, `log`, `diff`, `show`, `branch` and `remote` commands and single `gh pr`, `issue`, `repo`, `search` and `api` commands, with no chaining, so the agent can review a pull request without building or running it. See [Safely](/response#safely).

**A repository nobody has worked in.** Under **Security Inventory → Settings**, **Repos no agent has worked in** can be set to **Alert on first use** or **Block**, so a fresh clone gets a look before an agent works in it.

**Lockdown after a risky read.** A rule can lock a session's shell down after a web fetch or a likely injection: no network, no credentials, writes only inside the repository. See [Lockdown](/shield#lockdown).

## What Golem does not do

- The sandbox needs a Mac with Apple silicon, macOS 26 or later, and Claude Code installed, because the child agent is a Claude Code session. Elsewhere its tools report that it is unavailable.
- Isolation does not detect anything. It limits what hostile content can reach, and reports what was tried.
- The returned patch is the stranger's influence carried back. Your agent, and you, review it before it is applied.
- A `sandbox_run` command runs for 2 minutes by default and 10 at most, and a task for 10 minutes by default and 30 at most. Long builds do not fit.

## Read next

- [Shell jail and sandbox](/shield)
- [Block, hold and contain](/response)
- [Limits](/limits#where-each-layer-works)