Prompt injection can't be fixed.
It can be contained.
Brainbox is a self-hosted appliance OS for AI agents. Every session works inside its own sealed machine, on hardware you own — when one is compromised, the damage ends at its walls. Under the hood: one microVM per session, own kernel, own egress policy — enforced by the hypervisor, not by a prompt.
Running unattended for months: 1,179 published studies re-run by agents on a handful of self-hosted machines — doesitreproduce.com
Why containment, not detection
The industry consensus caught up in 2025: you cannot filter your way out of this.
An agent is an AI that acts: it reads mail, opens files, runs commands. And it follows instructions hidden in whatever it reads — a supplier's PDF, a web page, a calendar invite. That is prompt injection. There is no reliable filter against it, and the vendors say so themselves.
Meta put it plainly — prompt injection is “a fundamental, unsolved weakness in all LLMs.” Guardrails that catch 95% of attacks sound impressive until you remember that in security, 95% is a failing grade. So Brainbox does not try to detect a malicious instruction. It caps what a compromised agent can reach: one microVM, one work volume, one egress policy. When a session goes wrong, you delete the session.
10 of 11 coding agents talked past their own allowlist
Shell quoting and command substitution defeated the permission checks of Cline, Aider, OpenHands, Roo-Code and others. The string that gets inspected was not the command that ran. A hypervisor boundary does not have that class of bug.
An agent deleted a production database during a code freeze
The freeze existed in the prompt, not in the execution path. That is the whole lesson: rules an agent is asked to follow are not rules a system enforces. Fortune's report →
Read the reporting
Don't take this page's word for it. Freely readable coverage from serious outlets — this is the state of play:
- Samsung bans use of generative AI tools like ChatGPT after April internal data leak TechCrunch · May 2023 — engineers pasted confidential source code into a chatbot
- “EchoLeak” AI attack enabled theft of sensitive data via Microsoft 365 Copilot SecurityWeek · June 2025 — the first zero-click attack on an AI agent: one crafted email, no interaction needed
- Malicious Nx packages in “s1ngularity” attack leaked 2,349 GitHub, cloud, and AI credentials The Hacker News · August 2025 — malware turned victims' own AI assistants into credential-stealing tools
- UK intelligence warns AI “prompt injection” attacks might never go away The Record · December 2025 — the NCSC says the flaw is structural, not a bug to patch
- AI agents can escape sandboxes without ever breaking them CSO Online · July 2026 — agents “follow every rule” and still reach outside their sandbox
In plain terms
If you don't run servers, this section is yours. The one after it is for the people who do.
Your data stays in the building
Brainbox runs on machines you own — an old tower, a Raspberry Pi, a VM on the NAS. No cloud account holds your files; what an agent works on lives in your house and stays there unless a rule you set says otherwise.
One bad session stays one bad session
Like fire compartments in a building: one compartment can have an incident — it doesn't spread. A tricked agent can damage only its own sealed workspace. Patient records, case files, the mail archive — out of reach unless you explicitly hand them in.
You can always pull the plug
It's a box in your building, not a service in someone else's. When a session goes wrong, you delete the session. When you want everything to stop, you turn the box off.
What actually runs on the box
Not a wrapper around containers. If your current fix is “the agent only runs in Docker here”, this is the section for you.
- One microVM per session. A minimal PID 1 and a microVM monitor start a real virtual machine per agent session — own kernel, not a namespace on yours.
- Close the laptop. The work continues. Sessions live on the box, not in your terminal. Reconnect from anywhere and the agent is still where you left it — or three hours further along.
- Ten agents, none of them aware of each other. Each session gets its own machine's worth of separation, with a fair-share scheduler deciding who gets the cores.
- Add machines, not subscriptions. A Raspberry Pi, the old x86 tower, a VM on your NAS — every machine you add becomes capacity in the same fleet.
- Some steps stop and wait for you. An agent can pause and ask its owner — the session waits for the answer. Steps you mark as requiring approval, and destructive ones like deleting a session or removing a device, need a second factor from your phone before they proceed. The gate is fail-closed: if approval cannot be confirmed, nothing happens.
- Deny-by-default egress. A session reaches the network only where policy allows, with the credentials brokered outside the VM — never handed to the agent.
- Readable end to end. The isolation layer is published, so you can check the claims on this page instead of trusting them.
Pre-release. The command surface is still moving; the isolation model is not.
It is already doing real work
Not a demo. Months of unattended operation on self-hosted machines.
Does It Reproduce? performs autonomous, AI-driven re-runs of published computational biomedical pipelines: it reads the paper, fetches the data, re-runs the analysis and scores how well the result holds up. Nobody queues the papers or restarts what crashed. It is Brainbox's first serious workload and its toughest test.
Explore the reproductions →
These figures are read live from the project itself, each time this page is served.
Straight answers
The questions that decide whether this is for you.
What do I need to run it?
A machine of your own: a Raspberry Pi, a spare x86 box, or a VM on your NAS or hypervisor. Installable images for all three follow shortly after the source release. You operate everything from a browser.
What does it cost?
Nothing, for noncommercial use — the software is free under PolyForm Noncommercial 1.0.0, and it runs on hardware you already have. No subscription, no metered billing. Commercial use requires a separate license.
Where does the AI model run?
Brainbox is the infrastructure underneath agents, not a model host. You bring your own model access — a local model if your hardware carries it, or your existing provider account. Either way, a session reaches the network only where its egress policy allows.
Can it work with confidential files — client records, patient data?
That decision stays yours, and so do the files: workspaces live on your machines, each session is sealed off from the others, and what a session may send out is set by policy, not by the agent's goodwill. Germany's Federal Bar recommends AI providers with servers in Germany or Europe — one server location passes every test: your own.
Can I stop an agent before it does something I did not intend?
That is built into how sessions run, not bolted on. An agent can put a question to its owner and wait; you answer it from the start screen without opening the session. Anything marked as needing approval — and destructive actions by default — pauses until you confirm with a second factor. Because the gate is fail-closed, silence means the action does not happen: the failure mode is a stalled agent, never an unauthorised one.
Is Brainbox certified?
Brainbox claims no certifications, and this page makes no compliance promises. What it changes is simpler: processing happens on machines you own, so the question “where is our data?” has a one-word answer — here.
Be there on day one
The source opens 9 August 2026. Installable images for Raspberry Pi, x86 and virtual machines follow shortly after.
License
Brainbox will be published under PolyForm Noncommercial 1.0.0: free to use, study, modify and share for noncommercial purposes. Commercial use requires a separate license — planning one? Write to support@brainarbeit.com. Project names and logos are not covered by the code license.