Market and competitive analysis

1. The market in one paragraph

The buyer is whoever lets an agent run commands, read files, call tools and hold credentials on their behalf: a developer using Claude Code, Codex, Gemini CLI, Cursor or Antigravity; a platform team running agent fleets on Kubernetes or in cloud sandboxes; an enterprise security team that now carries agents on its risk register. The reason it is a market now is that prompt injection is unsolved and officially named as the central threat: the May 2026 guidance from the Five Eyes agencies, co-signed by the UK NCSC, calls it "the most persistent and difficult-to-fix threat" and says "no single control is sufficient" (CSA research note, secondary); Simon Willison's "lethal trifecta" (private data, untrusted content, a way to communicate out) argues that a 95 percent detection rate "is very much a failing grade" (simonwillison.net). Between late 2025 and late 2026 the industry moved visibly from classifier guardrails towards enforcement the model cannot talk its way past: OS sandboxes on by default in Codex and Cursor; Anthropic open-sourcing its bubblewrap and Seatbelt runtime (October 2025); Docker, Fly.io, Cloudflare, Vercel and Microsoft launching microVM or isolate sandboxes for agents (January to April 2026); NVIDIA's OpenShell keeping provider credentials outside the sandbox; and credential brokering (the agent sees a placeholder, a proxy swaps in the real key) appearing in Claude Code, Docker Sandboxes, Cloudflare, 1Password, Infisical and several small open-source tools. Money followed: Zenity ($125M, August 2026), Obsidian ($85M at $1.1B, August 2026), HiddenLayer ($100M, September 2026), Oasis ($120M, March 2026), Straiker ($64M, June 2026), and acquisitions of Lakera, Prompt Security, Aim, Protect AI, CalypsoAI, Portkey and Astrix (§6). Gartner's framing, "guardian agents" taking "at least 10 to 15%" of the agentic AI market by 2030, is the analyst number most quoted (Gartner, 11 Jun 2025). SHarness enters a market that has accepted its premise, kernel enforcement and secrets outside the agent, and is now arguing about granularity, portability, and who runs the launcher.

2. Agent and code sandboxes and runtimes

One boundary around the whole agent: a namespace, a container, a microVM. The agent, its tools, its credentials and its network client stay together inside it.

3. Policy, guardrails and prompt-injection defences

Rules the model reads, classifiers on its input and output, and authorisation engines that decide but do not enforce.

4. MCP and tool security

5. LLM gateways and key holders

What sharness.llm would be, minus the lock: these hold the provider key and apply policy, as ordinary network services with full OS privileges.

6. Secrets, workload identity, confidential computing, agent identity

What sharness.kms would sit beside or draw from.

7. Enterprise agent-security platforms: enforcement or monitoring

The observation that matters for SHarness: every platform in this table enforces, where it enforces at all, at a proxy, an API hook or a SaaS layer. None claims kernel-level, per-process confinement. The few products that name the kernel at all (Antigravity, Codex, Claude Code's sandbox, OpenShell) are the vendors' own agent products, not third-party platforms.

8. Standards, frameworks, reports, and a second pass on five claims

The second pass. Five rows a reader would lean on were re-read on their primary pages by a second agent session on 24 Oct 2026: Docker Sandboxes (all four claims confirmed, post dated 16 Apr 2026); Zenity's round ($125M, Norwest, $185M total, confirmed; the "block" wording is the reporter's); the OWASP ASI date (confirmed, 9 Dec 2025; the ASI names and mitigations are in the PDF, taken here from a secondary summary); NVIDIA NemoClaw (the overview page does not name Landlock or seccomp, and says enforcement "varies by host"; the table now uses the page's own words); the DeepSeek Harness CVE (the page returned 403; marked not verified). Everything else stands on the single read recorded in its row.

9. Where SHarness sits

Not a sandbox product and not a guardrail: a process architecture. Everything in §2 draws one boundary around the whole agent and leaves the agent, its tools, its credentials and its network client together inside it. SHarness's distinctive claims, all designed and none built:

1. Per-component kernel least privilege. Single-purpose processes (launcher, kms, net, fs, bash, llm), each with its own ephemeral uid, Landlock ruleset, seccomp allowlist, namespaces, no_new_privs and cgroup limits, talking only over a deny-by-default mutual TLS edge matrix issued by a session CA whose key is destroyed after issuing. The nearest analogues are OpenShell (one sandbox, not several) and Wassette (per-tool deny by default, in Wasm rather than the kernel).
2. A KMS that never returns a clear key. Keys sealed to one-time keys; the private key in a frozen process in a memfd_secret page; an empty network namespace; no filesystem rights after start. Nobody in this survey does this for agent credentials. The market's current best practice is "inject at the proxy so the agent sees a sentinel" (Claude Code's mask, Docker Sandboxes, Cloudflare, Infisical, Cloak), which still puts the clear key in a proxy process the agent can reach over loopback.
3. A policy hash supplied from outside the agent, layers composed by intersection, so a prompt-injected agent cannot widen its own grant. Claude Code's managed settings and Antigravity's presets are the commercial equivalents, and both are settings read by the agent process itself: a setting in ABP's terms, not a boundary.
4. The LLM gateway as a locked component with a secret filter on tool results, Messages API compatible. LiteLLM, Portkey and Cloudflare AI Gateway hold keys and apply guardrails as ordinary services with full OS privileges.
5. Transparent versus harness-aware apps. An unmodified app gets a folder from sharness.fs, HTTPS_PROXY to sharness.net, a model endpoint at sharness.llm, a shell via sharness.bash; only secret handling needs code changes.

Reuse rather than rebuild. Landlock bindings and CLI patterns from landrun; bubblewrap as the namespace primitive, and the proxy, allowlist and credential-mask semantics from Anthropic's sandbox-runtime; Cedar for a policy language and for static analysis of grants, as ToolHive does; SPIFFE SVID formats for the per-component certificates, so identity products can consume them; OpenTelemetry and OCSF trace shapes from OWASP's Agent Control Standard, so platforms like Zenity can ingest SHarness events; Wassette for tools that compile to Wasm; Firecracker, Docker Sandboxes or Agent Sandbox as the outer boundary in topologies where the launcher runs outside the agent. The measured 3.2 ms per mutual TLS handshake and 49 ms per ephemeral user (Evidence) say the per-component design is affordable.

Direct competitors (same job, same buyer): NVIDIA OpenShell and NemoClaw (closest in keeping credentials off the agent); Anthropic's sandbox-runtime with credential masking and managed settings (the default path for Claude Code users); Codex CLI's Landlock and seccomp sandbox; Antigravity's sandbox; Docker Sandboxes (credentials injected outside the microVM, central policy); Cloudflare Dynamic Workers (credential injection at egress); microsandbox.

Complements (SHarness could be their enforcement layer): the platforms in §7, which monitor and block at API hooks and would gain a kernel-enforced boundary to point at; identity products (Okta, Entra Agent ID, Keycard, Oasis, Teleport), which issue identity but do not confine; secrets managers (1Password's broker, Infisical, Vault, AgentCore Identity) as the upstream for sharness.kms; LLM gateways, which could sit behind sharness.llm; MCP gateways (ToolHive, Docker's), whose servers could run as harnessed apps; and ABP, which measures grants and would use SHarness as the control that turns an expectation into a boundary.

Honest gaps. Nothing is built, while the competitors ship today with daily users. SHarness is Linux-only by construction (Landlock 5.13+, TCP rules in newer kernels, memfd_secret), while buyers' desktops are often macOS and Windows, which Anthropic, OpenAI and Google cover with Seatbelt and AppContainer. Landlock and unprivileged user namespaces are often unavailable inside CI containers and hardened distributions. Root and kernel compromise are out of scope, whereas microVM vendors sell a hardware boundary. There is no cloud offering, no user interface, no team, no compliance story (SOC 2, ISO 42001 mapping, ACS traces), no CVE process. Several processes, a session CA and a KMS protocol are more surface than one bubblewrap profile. And the site's own caveat decides the value: "who runs the launcher decides what the locks are" (Components).

10. Market signals, with numbers

• Acquisitions, 2025 to 2026: Protect AI to Palo Alto (announced Apr 2025, closed Jul 2025, about $500M estimated); Invariant Labs to Snyk (Jun 2025); Aim Security to Cato (3 Sep 2025, $350M to $400M estimated); Prompt Security to SentinelOne (closed 5 Sep 2025; $133.6M cash plus shares and options per the 10-Q); CalypsoAI to F5 ($180M, Sep 2025); Lakera to Check Point (closed 22 Oct 2025, about $300M estimated); Portkey to Palo Alto (intent, about 30 Apr 2026); Astrix to Cisco (intent, May 2026, $250M to $400M reported). Sources in §3, §5, §6 and §7.
• Funding, 2025 to 2026: Noma $100M (Jul 2025); Keycard $38M (Oct 2025); Daytona $24M (Feb 2026); Portkey $15M (Feb 2026); WitnessAI $58M (Jan 2026, not verified); Oasis $120M (Mar 2026); OpenRouter $113M at about $1.3B (May 2026); Straiker $64M (Jun 2026); Zenity $125M (Aug 2026); Obsidian $85M at $1.1B (Aug 2026); HiddenLayer $100M (Sep 2026); Reco $55M (TechCrunch, 29 Sep 2026, whose headline says the market is crowded); Cyera $400M at $9B (Jan 2026) and $600M at $12B (Jun 2026). One blog's aggregation puts the top ten agentic-AI security start-ups at about $3.6B raised, $1.7B of it Cyera (Software Strategies, not verified).
• Standards: OWASP ASI Top 10 (9 Dec 2025); OWASP Agent Control Standard and the 2026 LLM Top 10 (Sep 2026); NIST CAISI initiative (17 Feb 2026); Five Eyes agentic guidance (1 May 2026); EN ISO/IEC 42001:2026 (1 Mar 2026).
• Platform moves: Anthropic open-sourced sandbox-runtime (20 Oct 2025); Fly Sprites (13 Jan 2026); Cloudflare Dynamic Workers beta (24 Mar 2026); the Kubernetes Agent Sandbox post (20 Mar 2026); Docker Sandboxes (early Apr 2026); Cloudflare Sandboxes GA (Apr 2026); Foundry hosted agents GA (Jun 2026); OpenAI Private Inference preview (29 Sep 2026).
• Incidents: an Antigravity sandbox escape (Pillar Security, patched); a Cursor sandbox escape fixed in 3.0; the DeepSeek Harness CVE (not verified); a reported LiteLLM PyPI compromise (24 Mar 2026, not verified); 30+ MCP CVEs between January and early March 2026 (CSA).

11. Threats to the thesis

1. Platforms are building it in. Anthropic ships credential masking, domain allowlists and admin-locked sandbox settings; Docker injects credentials outside the microVM under central policy; Cloudflare injects at egress; NVIDIA keeps provider credentials outside OpenShell. A developer running Claude Code inside Docker Sandboxes with masked credentials gets much of SHarness's practical benefit today, with two vendors' support. SHarness has to show that the residual gap (a clear key reachable in the proxy, one uid for agent and tools, settings rather than boundaries) is one people will act on.
2. Hardware boundaries may be "good enough". The market has largely settled on a microVM per session. If the blast radius of a prompt-injected agent is one disposable VM with scoped credentials, fine-grained least privilege inside it may look like diminishing returns.
3. Confidential computing absorbs the budget. TEEs answer a different question (trust in the operator) but give buyers a "secure AI" story that does not involve process confinement.
4. Agents move server-side. Claude Code on the web, Foundry hosted agents, AgentCore, Codex cloud: when the vendor runs the sandbox and holds the credentials, the vendor has answered "who runs the launcher" and a local harness has no role. The design's topology E is the same answer from the other side.
5. Standards converge on identity and traces, not process architecture. Procurement checklists may never ask for Landlock.
6. Portability. Linux-only kernel features exclude macOS and Windows desktops and many CI containers; the vendors who chose Seatbelt and AppContainer did so for reach.
7. Complexity and trust. With no code, no audits and no published threat-model document, early adopters have nothing to verify. The honest status labels are a strength for credibility and a weakness for adoption until the first component ships.

12. What this page does not claim

• It is a survey on one day by one agent session, with a second pass on five rows. Prices, round sizes and dates from secondary sources are marked as such; none is confirmed with the companies.
• It does not rank products, recommend any, or describe any platform's plans beyond what its public pages say.
• Nothing about SHarness in it is built; the comparison is between products that exist and a design.

Sources: every row's links, all read 24 Oct 2026; sharness.ai/llms.txt and Components for the SHarness claims; the research note for the design review this analysis follows.