CAIN-42 CAIN StudioAGENTIC AI 75 · #20
Operating-system-enforced agent containment
Microsoft announced Execution Containers to constrain agent access and actions on PCs.
Last reviewed 2026-11-11
Agentic AI 75 / #20
2026 status: Reported release announcement · Category: Endpoint security
The 2026 development
Microsoft announced Execution Containers to constrain agent access and actions on PCs.
The governance gap
An instruction in a prompt is not a security boundary. The boundary has to sit below the agent: filesystem, network, process and secrets, enforced by the OS and verified at run time.
Where CAIN-42 fits: Moat 6 — Adversarial Trust Engine
Core question: Can CAIN break its own guarantees? Continuous attack, mutation and red-team testing of the controls themselves.
Layer OS controls under the application decision: Landlock and seccomp for filesystem and syscalls, an eBPF guard for runtime events, and a sandbox that starts with no inherited secrets. CAIN's isolation and Talos paths implement parts of this on Linux.
How the wiring works
- Start the agent in a sandbox with a read-only root and no inherited environment secrets.
- Apply a syscall and filesystem policy before the first tool call.
- Monitor runtime events for policy divergence.
- Terminate and preserve the sandbox state when the policy is violated.
What is real today
LIBRARY Production code and tests exist in this repository; there is no hosted route for this exact use.
The Linux controls exist and are tested on this host class. There is no Windows or macOS execution-container implementation here, and no claim of parity with Microsoft.
| Component in this repository | What the module says it is |
|---|---|
cain/landlock_sandbox.py | Landlock filesystem (and optional TCP) restriction for processes CAIN launches -- Sovereign Evolution 3. |
cain/ebpf_enforcer.py | CAIN-42 kernel enforcement with eBPF (A+++ gate 5), without the BPF LSM. |
cain/isolation/sandbox.py | Hardened Execution Isolation Fabric — Evolution 6: Project Sovereign Isolation. |
cain/talos/talos_sandbox_launcher.py | TALOS sandbox launcher. Run as a program (``python -I talos_sandbox_launcher.py``), never imported by the |
Descriptions are the first line of each module's own docstring, read without importing it. A module path is a pointer into this repository, not a hosted endpoint. Its existence is checked by the test suite; its status for this use is the label above.
Check it yourself
- Fire a live governed decision
/fabric/try - Fire a live decision through the CAIN-42 pipeline
/fabric/try— the same enforcement path every product sits behind.
Commercial package
| Offer | OS Containment Review |
|---|---|
| Buyer | Endpoint vendors and enterprise IT |
| Price (proposal) | $5,000–$12,000 per review |
| Bundle | Runtime Containment & Evidence — Contain first, then prove what happened. |
| Operator stream | Stream 2 of the 10-stream operator playbook |
SOC, incident response, compliance, enterprise IT is the bundle buyer. The entry offer for this bundle is Runtime containment review; signed evidence pack; the range is $2,500–$5,000 per review; $2,000–$10,000 per evidence pack. A price on this page is a proposal, not a validated rate, and no customer is claimed.
Buy this as a product or service
CAIN-A75-020 — OS Containment Review DELIVERABLE
A bounded engine run on the buyer's sample: findings, a written report, and a SHA-256 artifact manifest. The manifest is unsigned: it is not a signature and not an attestation.
Kind: Assessment · Price (proposal): $5,000–$12,000 per review · Lead time: 5 business days.
Open the product page · all 75 products
What this page does not claim
What this page is not. CAIN-42 is not affiliated with, endorsed by, integrated into, or shipped with the organisation named in the 2026 item. The item is public context; the page describes how CAIN-42 would govern that class of capability. No page here claims a customer, a partnership, a certification, a patent, or a production integration. Prices are proposals. Built by a three-person team.