{"slug": "jai", "name": "jai", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 7, "warners": 1, "score": 3.288, "rising": -1.31, "first": "2026-03-07", "latest": "2026-07-15", "why": "I've been using jai [1] for sandboxing on linux (although I use opencode and local models and not claude code) and I'm pretty satisfied with it.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 2, "compare": 0, "warn": 1}, "spark": [0, 0, 0, 0, 1, 0, 0, 2, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I've been using jai [1] for sandboxing on linux (although I use opencode and local models and not claude code) and I'm pretty satisfied with it.", "icon": true, "domain": "stanford.edu", "github_repo": null, "official_url": "https://jai.scs.stanford.edu", "pricing": "", "aliases": ["jai", "MOSS"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 782685457, "item_id": 48917841, "url": "https://news.ycombinator.com/item?id=48917841", "by": "rmunn", "date": "2026-07-15", "stance": "recommend", "quote": "if anyone is interested in a decent setup for an AI agent jail, the scripts at https://jai.scs.stanford.edu/arch-vm.html are what I used", "excerpt": "I've been running Claude Code in a VM, where I clone the GitHub repos I want it to work on (they're open source so no login info needed) but have no other credentials. I used to reset the VM every day, but that was getting to be a bit of a hassle so I switched to a monthly reset. But even so, it would be hard for Claude to exfil anything more than what open-source projects I've been working on in the past month (at w", "context": "", "use_case": "AI agent sandbox VM", "switched_from": "", "story": "I tricked Claude into leaking your deepest, darkest secrets"}, {"id": 774956096, "item_id": 48434756, "url": "https://news.ycombinator.com/item?id=48434756", "by": "johnsonjo", "date": "2026-06-07", "stance": "recommend", "quote": "I've been using jai [1] for sandboxing on linux (although I use opencode and local models and not claude code) and I'm pretty satisfied with it.", "excerpt": "I've been using jai [1] for sandboxing on linux (although I use opencode and local models and not claude code) and I'm pretty satisfied with it. It comes in three different modes [2]: casual mode, strict mode, and bare mode. Here's some descriptions of each mode: Casual mode [3]: > Your home directory is mounted as a copy-on-write overlay. The jailed process sees your real files, but writes go to $HOME/.jai/default.c", "context": "Linux user running local models", "use_case": "sandboxing AI agents on Linux", "switched_from": "", "story": "Anthropic, please ship an official Claude Desktop for Linux"}, {"id": 774954448, "item_id": 48434653, "url": "https://news.ycombinator.com/item?id=48434653", "by": "mathstuf", "date": "2026-06-07", "stance": "recommend", "quote": "I use jai: https://jai.scs.stanford.edu/", "excerpt": "There are a number of utilities for this. I use jai: https://jai.scs.stanford.edu/ but also have seen nono: https://github.com/always-further/nono smolvm: https://github.com/smol-machines/smolvm zerobox https://github.com/afshinm/zerobox and matchlock https://github.com/jingkaihe/matchlock They all have pros and cons. Pick the one that suits you best. Then you're also agent harness flexible (I use opencode).", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Anthropic, please ship an official Claude Desktop for Linux"}, {"id": 760837600, "item_id": 47552350, "url": "https://news.ycombinator.com/item?id=47552350", "by": "srcoder", "date": "2026-03-28", "stance": "recommend", "quote": "Nice tool, def gonna try it.", "excerpt": "Nice tool, def gonna try it. I was looking for the source and it took a while before I found the github(0) link. Like a lot software, I like to take a look at source. Maybe you can make it more prominent on the website 0: https://github.com/stanford-scs/jai", "context": "", "use_case": "CLI sandboxing", "switched_from": "", "story": "Don't YOLO your file system"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 760849472, "item_id": 47553092, "url": "https://news.ycombinator.com/item?id=47553092", "by": "GistNoesis", "date": "2026-03-28", "stance": "warn", "quote": "go on run malware on your computer but do so with our casual sandbox at your own risk.", "excerpt": "TLDR: It's easy : LLM outputs are untrusted. Agents by virtue of running untrusted inputs are malware. Handle them like the malware they are. >>> \"While this web site was obviously made by an LLM\" So I am expecting to trust the LLM written security model https://jai.scs.stanford.edu/security.html These guys are experts from a prestigious academic institution. Leading \"Secure Computer Systems\", whose logo is a 7 branc", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Don't YOLO your file system"}]}], "who": [{"by": "johnsonjo", "context": "Linux user running local models", "url": "https://news.ycombinator.com/item?id=48434756", "date": "2026-06-07"}, {"by": "Manuel_D", "context": "former CS section leader", "url": "https://news.ycombinator.com/item?id=48394117", "date": "2026-06-03"}, {"by": "dehrmann", "context": "former CS teaching assistant", "url": "https://news.ycombinator.com/item?id=47292379", "date": "2026-03-07"}], "tags": [], "use_cases": ["ai agent sandbox vm", "sandboxing ai agents on linux", "sandboxing ai agents", "plagiarism detection in code", "agent sandboxing", "cli sandboxing"], "compared": [{"slug": "opencode", "name": "OpenCode", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "claude-code", "name": "Claude Code", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 756005856, "item_id": 47250366, "url": "https://news.ycombinator.com/item?id=47250366", "by": "heyitsgarrett", "date": "2026-03-04", "stance": "recommend", "quote": "MOSS is a drawing toy where each brush is a tiny script that knows about every pixel on the canvas.", "excerpt": "Oh thanks for sharing this! I love asesprite, procreate, pico8 and had this idea for programmable brushes bonking around my head for years now. Recently took some time between projects to put it together. MOSS is a drawing toy where each brush is a tiny script that knows about every pixel on the canvas. You define how it paints with noise, randomness, patterns, stroke speed, pressure, and every touch executes the cod", "context": "", "use_case": "programmable pixel brushes", "switched_from": "", "story": "Moss is a pixel canvas where every brush is a tiny program"}], "threads": [{"url": "https://news.ycombinator.com/item?id=48434436", "title": "Anthropic, please ship an official Claude Desktop for Linux", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=47550282", "title": "Don't YOLO your file system", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48916975", "title": "I tricked Claude into leaking your deepest, darkest secrets", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48392004", "title": "Failing grades soar with AI usage, dwindling math skills in Berkeley CS classes", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47290457", "title": "We're Training Students to Write Worse to Prove They're Not Robots", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47245491", "title": "Moss is a pixel canvas where every brush is a tiny program", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"neutral": 1, "recommend": 1, "warn": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {"neutral": 1, "recommend": 2}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 782685457, "item_id": 48917841, "url": "https://news.ycombinator.com/item?id=48917841", "by": "rmunn", "date": "2026-07-15", "stance": "recommend", "quote": "if anyone is interested in a decent setup for an AI agent jail, the scripts at https://jai.scs.stanford.edu/arch-vm.html are what I used", "excerpt": "I've been running Claude Code in a VM, where I clone the GitHub repos I want it to work on (they're open source so no login info needed) but have no other credentials. I used to reset the VM every day, but that was getting to be a bit of a hassle so I switched to a monthly reset. But even so, it would be hard for Claude to exfil anything more than what open-source projects I've been working on in the past month (at w", "context": "", "use_case": "AI agent sandbox VM", "switched_from": "", "story": "I tricked Claude into leaking your deepest, darkest secrets"}, {"id": 774956096, "item_id": 48434756, "url": "https://news.ycombinator.com/item?id=48434756", "by": "johnsonjo", "date": "2026-06-07", "stance": "recommend", "quote": "I've been using jai [1] for sandboxing on linux (although I use opencode and local models and not claude code) and I'm pretty satisfied with it.", "excerpt": "I've been using jai [1] for sandboxing on linux (although I use opencode and local models and not claude code) and I'm pretty satisfied with it. It comes in three different modes [2]: casual mode, strict mode, and bare mode. Here's some descriptions of each mode: Casual mode [3]: > Your home directory is mounted as a copy-on-write overlay. The jailed process sees your real files, but writes go to $HOME/.jai/default.c", "context": "Linux user running local models", "use_case": "sandboxing AI agents on Linux", "switched_from": "", "story": "Anthropic, please ship an official Claude Desktop for Linux"}, {"id": 774954448, "item_id": 48434653, "url": "https://news.ycombinator.com/item?id=48434653", "by": "mathstuf", "date": "2026-06-07", "stance": "recommend", "quote": "I use jai: https://jai.scs.stanford.edu/", "excerpt": "There are a number of utilities for this. I use jai: https://jai.scs.stanford.edu/ but also have seen nono: https://github.com/always-further/nono smolvm: https://github.com/smol-machines/smolvm zerobox https://github.com/afshinm/zerobox and matchlock https://github.com/jingkaihe/matchlock They all have pros and cons. Pick the one that suits you best. Then you're also agent harness flexible (I use opencode).", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Anthropic, please ship an official Claude Desktop for Linux"}, {"id": 774305872, "item_id": 48394117, "url": "https://news.ycombinator.com/item?id=48394117", "by": "Manuel_D", "date": "2026-06-03", "stance": "neutral", "quote": "When I was a section leader we used MOSS", "excerpt": "When I was a section leader we used MOSS: https://theory.stanford.edu/~aiken/moss/ It's not AI, its a deterministic program that analyzes compiled code for similarity.", "context": "former CS section leader", "use_case": "plagiarism detection in code", "switched_from": "", "story": "Failing grades soar with AI usage, dwindling math skills in Berkeley CS classes"}, {"id": 760849472, "item_id": 47553092, "url": "https://news.ycombinator.com/item?id=47553092", "by": "GistNoesis", "date": "2026-03-28", "stance": "warn", "quote": "go on run malware on your computer but do so with our casual sandbox at your own risk.", "excerpt": "TLDR: It's easy : LLM outputs are untrusted. Agents by virtue of running untrusted inputs are malware. Handle them like the malware they are. >>> \"While this web site was obviously made by an LLM\" So I am expecting to trust the LLM written security model https://jai.scs.stanford.edu/security.html These guys are experts from a prestigious academic institution. Leading \"Secure Computer Systems\", whose logo is a 7 branc", "context": "", "use_case": "agent sandboxing", "switched_from": "", "story": "Don't YOLO your file system"}, {"id": 760837600, "item_id": 47552350, "url": "https://news.ycombinator.com/item?id=47552350", "by": "srcoder", "date": "2026-03-28", "stance": "recommend", "quote": "Nice tool, def gonna try it.", "excerpt": "Nice tool, def gonna try it. I was looking for the source and it took a while before I found the github(0) link. Like a lot software, I like to take a look at source. Maybe you can make it more prominent on the website 0: https://github.com/stanford-scs/jai", "context": "", "use_case": "CLI sandboxing", "switched_from": "", "story": "Don't YOLO your file system"}, {"id": 756678064, "item_id": 47292379, "url": "https://news.ycombinator.com/item?id=47292379", "by": "dehrmann", "date": "2026-03-07", "stance": "neutral", "quote": "We used MOSS [1].", "excerpt": "20 years ago (so very outdated), I TAed an introductory CS class for engineers who weren't going to be majoring in CS. We used MOSS [1]. Maybe it was the threshold we picked, but the results were pretty blatant. People renamed variables, renamed functions, changed comments, and the clever ones inlined or extracted a function. A lot forgot something, copying a bug or quirk from the original. [1] https://theory.stanfor", "context": "former CS teaching assistant", "use_case": "detecting code plagiarism in class", "switched_from": "", "story": "We're Training Students to Write Worse to Prove They're Not Robots"}]}