# Market and competitive analysis

> **Status: a survey, as of 24 Oct 2026.** What exists in the market that does part of what SHarness is designed to do, who makes it, how it enforces, and what it leaves out; where SHarness sits; what it should reuse; and the reasons the market might not need it. Researched by sharness.build on 24 October 2026 from the sources listed on each row, every one read that day. *Not verified* marks a claim that appeared only in a secondary or vendor source, or whose primary page could not be read. Five load-bearing rows were re-checked against their primary pages by a second pass (§8). The editorial responsibility is Dinis Cruz's; nothing here is advice to buy or sell anything.

## 1. The market in one paragraph

The buyer is whoever lets an agent run commands, read files, call tools and hold credentials on their behalf: a developer using Claude Code, Codex, Gemini CLI, Cursor or Antigravity; a platform team running agent fleets on Kubernetes or in cloud sandboxes; an enterprise security team that now carries agents on its risk register. The reason it is a market now is that prompt injection is unsolved and officially named as the central threat: the May 2026 guidance from the Five Eyes agencies, co-signed by the UK NCSC, calls it "the most persistent and difficult-to-fix threat" and says "no single control is sufficient" ([CSA research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-cisa-agentic-ai-guidance), secondary); Simon Willison's "lethal trifecta" (private data, untrusted content, a way to communicate out) argues that a 95 percent detection rate "is very much a failing grade" ([simonwillison.net](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)). Between late 2025 and late 2026 the industry moved visibly from classifier guardrails towards enforcement the model cannot talk its way past: OS sandboxes on by default in Codex and Cursor; Anthropic open-sourcing its bubblewrap and Seatbelt runtime (October 2025); Docker, Fly.io, Cloudflare, Vercel and Microsoft launching microVM or isolate sandboxes for agents (January to April 2026); NVIDIA's OpenShell keeping provider credentials outside the sandbox; and credential brokering (the agent sees a placeholder, a proxy swaps in the real key) appearing in Claude Code, Docker Sandboxes, Cloudflare, 1Password, Infisical and several small open-source tools. Money followed: Zenity ($125M, August 2026), Obsidian ($85M at $1.1B, August 2026), HiddenLayer ($100M, September 2026), Oasis ($120M, March 2026), Straiker ($64M, June 2026), and acquisitions of Lakera, Prompt Security, Aim, Protect AI, CalypsoAI, Portkey and Astrix (§6). Gartner's framing, "guardian agents" taking "at least 10 to 15%" of the agentic AI market by 2030, is the analyst number most quoted ([Gartner, 11 Jun 2025](https://www.gartner.com/en/newsroom/press-releases/2025-06-11-gartner-predicts-that-guardian-agents-will-capture-10-15-percent-of-the-agentic-ai-market-by-2030)). SHarness enters a market that has accepted its premise, kernel enforcement and secrets outside the agent, and is now arguing about granularity, portability, and who runs the launcher.

## 2. Agent and code sandboxes and runtimes

One boundary around the whole agent: a namespace, a container, a microVM. The agent, its tools, its credentials and its network client stay together inside it.

| Product | Maker · licence | Mechanism | Covers | Does not cover | Source |
|---|---|---|---|---|---|
| Claude Code sandbox; `@anthropic-ai/sandbox-runtime` | Anthropic · Apache-2.0, "beta research preview" | Linux: bubblewrap, a separate network namespace, optional seccomp; macOS: Seatbelt; native Windows: unsandboxed. Every egress through a local proxy with a domain allowlist that starts empty | filesystem write scope; domain allowlist; credential masking (a placeholder in the sandbox, the proxy injects the real value on allowed hosts); admins can force it on through managed settings; "84% fewer permission prompts" (internal figure) | its own docs: "reduces risk but is not a complete isolation boundary"; file and web tools, hooks, local MCP servers, LSP and `apiKeyHelper` run with full access; most of the machine readable, `~/.ssh` included, unless denied; domain fronting can pass the allowlist | [docs](https://code.claude.com/docs/en/sandboxing) · [engineering post, 20 Oct 2025](https://anthropic.com/engineering/claude-code-sandboxing) · [repo](https://github.com/anthropic-experimental/sandbox-runtime) |
| Codex CLI sandbox | OpenAI · open-source CLI (licence not re-verified) | macOS Seatbelt; Linux Landlock for files and seccomp for network; Windows DACL per a community write-up. Modes read-only (default), workspace-write, danger-full-access; network off by default | per-command file and network restriction; `codex debug landlock` | OpenAI warns sandboxing may not work where Landlock or seccomp are unavailable; whether bubblewrap is also used on Linux is unsettled across sources; credentials not isolated | [Willison, 9 Nov 2025](https://simonwillison.net/2025/Nov/9/codex-sandbox-investigation/) · [write-up, 3 May 2026](https://codex.danielvaughan.com/2026/05/03/codex-cli-sandbox-internals-seatbelt-bubblewrap-landlock-windows-dacl/); the official security page redirected and was not fully read |
| Gemini CLI sandbox | Google · open source (licence not re-verified) | macOS Seatbelt (six profiles); Docker or Podman container; Windows low-integrity | writes outside the project; optional proxied network profiles | off by default; "reduces but does not eliminate all risks" | [docs](https://geminicli.com/docs/cli/sandbox.md) |
| Antigravity terminal sandbox | Google · commercial IDE and CLI | Linux kernel namespaces; macOS Seatbelt; Windows AppContainer | no network by default; `read_url` domains form the outbound allowlist | CLI sandbox off by default; business presets do not enable it; a sandbox escape through a native tool, reported by Pillar Security, since patched | [docs](https://www.antigravity.google/docs/sandbox?tab=cli) · [CyberScoop](https://cyberscoop.com/google-antigravity-pillar-security-agent-sandbox-escape-remote-code-execution/) |
| Cursor agent sandbox | Cursor · commercial | OS-level terminal sandbox, macOS first (Cursor 2.0): no file access outside the workspace, no network | default-on auto-run without network | an escape (write access to the working directory) fixed in 3.0; Linux and WSL2 AppArmor failures reported; details not verified | [docs](https://cursor.com/docs/agent/tools/terminal.md) · [forum](https://forum.cursor.com/t/agent-sandboxing-available-in-cursor-2-0/139449) |
| E2B | E2B · open-source infrastructure plus hosted, per-second billing | Firecracker microVM per sandbox | code execution, persistence; a provider for the OpenAI Agents SDK | no least-privilege model inside the VM | [pricing FAQ](https://docs.e2b.dev/faq/calculate-sandbox-price) |
| Modal Sandboxes | Modal · commercial, per-second | gVisor | CPU and GPU sandboxes | gVisor is a software boundary, not hardware; pricing not verified on modal.com | [comparison](https://www.morphllm.com/comparisons/e2b-vs-modal) (secondary) |
| Daytona | Daytona · open-source core plus hosted; $24M Series A, 5 Feb 2026 | sandboxes with snapshot and fork | agent compute | licence not verified | [tech.eu](https://tech.eu/2026/02/06/daytona-raises-24m-series-a-to-build-agent-native-compute-infrastructure/) |
| Fly.io Sprites | Fly.io · commercial, launched 13 Jan 2026 | a persistent Firecracker microVM with its own kernel | "cannot reach the agent's host, your secrets, or your network"; an MCP server for lifecycle | persistence across runs weakens per-task isolation | [DevClass](https://devclass.com/2026/01/13/fly-io-introduces-sprites-lightweight-persistent-vms-to-isolate-agentic-ai/) · [fly.io](https://fly.io/ai-agents/) |
| Vercel Sandbox | Vercel · commercial, usage billed | Firecracker microVM | ephemeral Node and Python execution | GA status and pricing from an aggregator, not verified | [Upstash comparison](https://upstash.com/blog/ai-agent-sandbox-providers-compared-2026) (secondary) |
| Cloudflare Dynamic Workers and Sandboxes | Cloudflare · commercial; Dynamic Workers open beta 24 Mar 2026, Sandboxes GA Apr 2026 | a V8 isolate per run; containers | outbound blocked by default; the platform injects credentials into outbound HTTP so code never sees them | isolates "have different security characteristics compared to hardware-backed environments" | [InfoQ](https://infoq.com/news/2026/04/cloudflare-dynamic-workers-beta) · [InfoQ](https://infoq.com/news/2026/04/cloudflare-sandboxes-ga) |
| Docker Sandboxes | Docker · free for individuals, enterprise via sales; launched early Apr 2026 | a microVM per session on Hypervisor.framework, WHP or KVM, with a private Docker daemon | "Credentials are injected at runtime and outside the MicroVM boundary"; network endpoints and files defined before the run; Claude Code, Codex, Gemini CLI, Copilot, Kiro, OpenClaw | no least privilege inside the VM; a cloud offering reported from one source, not verified | [Docker blog, 16 Apr 2026](https://www.docker.com/blog/why-microvms-the-architecture-behind-docker-sandboxes/) (re-checked, §8) |
| microsandbox | superradcompany · Apache-2.0 | embedded microVMs, sub-100 ms boot claimed; an MCP server | "secrets are kept outside the VM"; SDKs in four languages | version and dates not verified | [repo](https://github.com/superradcompany/microsandbox) |
| OpenSandbox | Alibaba · Apache-2.0, open-sourced 17 Dec 2025 | Docker and Kubernetes runtimes behind an OpenAPI protocol | command, file, code, browser and desktop sandboxes | adoption figures not verified | [landscape entry](https://landscape.jimmysong.io/projects/open-sandbox/) |
| Agent Sandbox (kubernetes-sigs) | Kubernetes SIG Apps, Google-initiated · Apache-2.0 | a Sandbox CRD that delegates isolation to gVisor or Kata through RuntimeClass | stable identity, persistent storage, warm pools | "a sandbox orchestrator": provides no isolation itself; threat model deferred | [overview](https://agent-sandbox.sigs.k8s.io/docs/getting_started/overview/) · [Kubernetes blog, 20 Mar 2026](https://kubernetes.io/blog/2026/03/20/running-agents-on-kubernetes-with-agent-sandbox) |
| Azure Container Apps dynamic sessions; Foundry hosted agents | Microsoft · commercial; sessions GA Nov 2024, hosted agents GA Jun 2026 | Hyper-V per session; per-session VM-isolated sandboxes | untrusted code interpreter; bring-your-own VNet | Foundry's hypervisor not named; SDKs pre-release | [docs](https://learn.microsoft.com/en-us/azure/container-apps/sessions-code-interpreter) · [Foundry blog](https://devblogs.microsoft.com/foundry/introducing-the-new-hosted-agents-in-foundry-agent-service-secure-scalable-compute-built-for-agents) |
| NVIDIA NemoClaw / OpenShell | NVIDIA · open source (licence not shown on the page) | "an OpenShell sandbox with documented filesystem, process, and network controls. Enforcement limitations vary by host" | "Provider credentials remain outside the sandbox"; "OpenShell blocks unapproved destinations and surfaces requests for operator review"; managed inference through `inference.local` for some providers | early 0.0.x versions; the overview page does not name Landlock or seccomp (a first pass had said it did; re-checked, §8) | [overview](https://docs.nvidia.com/nemoclaw/latest/about/overview) |
| Firecracker, gVisor, Kata | AWS, Google, OpenInfra · Apache-2.0 each (not re-verified) | KVM microVM; a userspace kernel intercepting syscalls; VM-wrapped containers | the primitives most of the rows above are built on | none controls secrets or per-tool privilege; gVisor I/O overhead of 10 to 30 percent claimed | [fly.io](https://fly.io/learn/firecracker-vs-gvisor/) · [Edera](https://edera.dev/stories/kata-vs-firecracker-vs-gvisor-isolation-compared) |
| nsjail, bubblewrap, landrun | Google, the containers project, Zouuup · open source | namespaces, cgroups and seccomp; user namespaces; per-process Landlock including TCP rules (kernel 5.13+) | unprivileged per-process confinement; landrun is the closest tool to SHarness's per-process Landlock | a reported CVE in "DeepSeek Harness" (CVE-2026-82533, CVSS 9.4) where a bubblewrap sandbox left loopback open so the agent reached its own control API: the page could not be read, **not verified** | [landrun](https://pkg.go.dev/github.com/zouuup/landrun) · [Coder nsjail](https://coder.com/docs/@main/ai-coder/agent-firewall/nsjail) · [OX Security](https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/) (403 on re-check) |

## 3. Policy, guardrails and prompt-injection defences

Rules the model reads, classifiers on its input and output, and authorisation engines that decide but do not enforce.

| Product | Maker · licence | Mechanism | Covers | Does not cover | Source |
|---|---|---|---|---|---|
| NeMo Guardrails | NVIDIA · Apache-2.0 | Colang flows; input and output rails; tool-call validation; MCP integration | conversational and agent rails | model-side; no OS enforcement | [docs](https://docs.nvidia.com/nemo/guardrails/home) |
| Lakera Guard | Check Point (acquired, announced 16 Sep 2025, closed 22 Oct 2025; about $300M, not confirmed) · commercial | a classifier API on inputs and outputs | prompt injection, PII, jailbreaks | detection, not enforcement | [Check Point](https://www.checkpoint.com/press-releases/check-point-acquires-lakera-to-deliver-end-to-end-ai-security-for-enterprises/) · [price estimate](https://www.venturelab.swiss/Lakera-acquired-by-Checkpoint-in-USD-300-million-deal) |
| Invariant Guardrails, mcp-scan | Snyk (acquired Jun 2025) · open-source scanner plus commercial | contextual rules on agent traces; static MCP scans; coined "tool poisoning" and "MCP rug pulls" | agent observability, MCP scanning | application layer only | [tech.eu](https://tech.eu/2025/06/24/snyk-acquires-ai-security-pioneer-invariant-labs-for-a-new-era-in-ai-safeguards/) |
| Guardrails AI | Guardrails AI · Apache-2.0 core plus Pro | validators | output validation | hub reportedly wound down 25 Aug 2026, not verified | [profile](https://appsecsanta.com/guardrails-ai) (secondary) |
| LlamaFirewall (PromptGuard 2, AlignmentCheck, CodeShield) | Meta · Llama licence | classifiers; a chain-of-thought auditor; Semgrep and regex | AgentDojo attack success rate 17.6% to 1.75% (paper) | probabilistic | [paper](https://arxiv.org/pdf/2505.03574) |
| CaMeL | Google DeepMind and ETH · research | a privileged and a quarantined LLM; capability-tagged values; a custom interpreter | 67% of AgentDojo tasks with provable security | research, not a product; the pattern SHarness's dual `sharness.llm` policies follow ([Agents §5](../agents/index.md#5-untrusted-text-two-models-two-components)) | [Willison on CaMeL](https://simonwillison.net/2025/Apr/11/camel/) |
| Prompt Shields, Spotlighting | Microsoft · commercial (Azure AI Content Safety) | classifier; spotlighting; task adherence | direct and indirect injection detection | detection only | [Azure blog](https://azure.microsoft.com/blog/announcing-new-tools-in-azure-ai-to-help-you-build-more-secure-and-trustworthy-generative-ai-applications/) |
| OpenFGA, Cedar, OPA for agents | Okta, AWS, Styra and CNCF · Apache-2.0 | relationship and attribute policy engines; OpenFGA's agents guide (zero-permission start, expiring grants); Cedar used by ToolHive | tool-level authorisation decisions | decision point only; enforcement is elsewhere | [OpenFGA](https://openfga.dev/docs/modeling/agents) · [Cedar for MCP](https://speakerdeck.com/luxas/what-can-your-ai-agents-actually-do-cedar-analysis-for-mcp-servers) · [Permit on OPA](https://www.permit.io/blog/opa-for-protecting-ai-agents-and-agentic-stacks) |
| Permit.io, Oso | Permit.io, Oso · open-source decision point plus SaaS; closed SaaS | a four-perimeter model (prompt, RAG, tool, MCP); query-level filtering | application-level authorisation for agents | not OS-level | [Permit](https://www.permit.io/blog/why-ai-agents-choose-permitio-for-authorization) · [comparison](https://www.decryptiondigest.com/blog/ai-agent-fine-grained-authorization-permit-io-cerbos-oso-comparison) |
| Agent Behaviour Policies (ABP) | RiskMandate, the same author as SHarness · code Apache-2.0, text CC BY 4.0 | mandate, grant, delta, barrier (none, expectation, setting, boundary) | describes and measures what an agent can and may do | no runtime enforcement: SHarness is its enforcement counterpart | [riskmandate.ai/abp](https://riskmandate.ai/abp.html) |

## 4. MCP and tool security

| Product | Maker · licence | Mechanism | Covers | Does not cover | Source |
|---|---|---|---|---|---|
| ToolHive | Stacklok · Apache-2.0 (not re-verified) | MCP servers in containers; JSON permission profiles (paths, hosts, ports); an egress proxy and DNS with `--isolate-network`; Cedar authorisation | filesystem and HTTP(S) egress per server | non-HTTP protocols need isolation off | [permissions](https://docs.stacklok.com/toolhive/guides-cli/custom-permissions) · [network isolation](https://docs.stacklok.com/toolhive/guides-cli/network-isolation) |
| Docker MCP Gateway and Toolkit | Docker · MIT (third-party report) | one container per tool; image signature verification; `--block-secrets`; secrets injected only into the container process | supply chain, secret-leak scanning | "no outbound network by default" from trade press only | [Docker blog](https://www.docker.com/blog/docker-mcp-gateway-secure-infrastructure-for-agentic-ai/) |
| Lasso MCP Gateway | Lasso · open source | a plugin proxy: injection, command injection, PII | detection in MCP flows | favours detection over performance | [IT Brief](https://itbrief.co.uk/story/lasso-introduces-first-security-gateway-for-mcp-workflows) |
| Enkrypt Secure MCP Gateway | Enkrypt AI · open source | auth, tool discovery, parameter validation, guardrails | the tool-call layer | content level, not OS | [Enkrypt](https://www.enkryptai.com/secure-mcp-gateway) |
| Pomerium MCP | Pomerium · open-source core plus enterprise | an identity-aware proxy; OAuth brokering; TLS termination | access to internal MCP servers | not execution isolation | [docs](https://www.pomerium.com/docs/capabilities/mcp) |
| Cloudflare MCP Server Portals | Cloudflare · commercial, open beta | Cloudflare Access in front of MCP servers; per-portal tool selection | zero-trust access, observability | prompt-injection rules promised, not shipped | [Cloudflare blog](https://blog.cloudflare.com/zero-trust-mcp-server-portals) |
| Scanners: mcp-scan, Cisco mcp-scanner, Snyk agent-scan, mcpsec, mcpradar | various · mostly open source | YARA, Semgrep and LLM analysis of tool descriptions and code | tool poisoning, rug pulls | an independent audit found 6 real hits of 27 across 10 servers and "none have independently audited detection rates"; 30+ MCP CVEs between January and early March 2026 (CSA) | [audit](https://appsecsanta.com/research/mcp-server-security-audit-2026) · [CSA note](https://labs.cloudsecurityalliance.org/agentic/csa-research-note-riskrubric-mcp-scanner-spec-20260327/) |
| Wassette | Microsoft · open source (Rust) | Wasmtime; WebAssembly components exposed as MCP tools; deny-by-default capabilities per path and endpoint | a tool execution sandbox | only tools compiled to Wasm; no protection from a bad server response | [Microsoft, 6 Aug 2025](https://opensource.microsoft.com/blog/2025/08/06/introducing-wassette-webassembly-based-tools-for-ai-agents/) |

## 5. LLM gateways and key holders

What `sharness.llm` would be, minus the lock: these hold the provider key and apply policy, as ordinary network services with full OS privileges.

| Product | Maker · licence | Mechanism | Covers | Does not cover | Source |
|---|---|---|---|---|---|
| LiteLLM Proxy | BerriAI · MIT core, enterprise licence for SSO and more | virtual keys, budgets, allowed models, guardrail hooks | key holding for 100+ providers | two PyPI releases reported to have shipped malicious code on 24 Mar 2026 (secondary, not verified); the process is not kernel-locked | [explainer](https://smartscope.blog/en/blog/litellm-explainer/) (secondary) |
| Portkey | Portkey, being acquired by Palo Alto Networks (intent about 30 Apr 2026) · MIT gateway plus SaaS; $15M Series A Feb 2026 | virtual keys in a vault, guardrails, PII redaction | governance, observability | close date unconfirmed | [Portkey](https://portkey.ai/blog/series-a-funding/) · [Pulse 2.0](https://pulse2.com/palo-alto-networks-to-acquire-portkey-to-establish-ai-gateway-as-control-plane-for-autonomous-enterprise-agents/) |
| Cloudflare AI Gateway | Cloudflare · commercial | bring-your-own keys in a secrets store; a gateway token replaces the provider key; guardrails, DLP | key custody, caching | per-team virtual keys and RBAC, per a comparison | [docs](https://developers.cloudflare.com/ai-gateway/configuration/bring-your-own-keys/) |
| Kong AI Gateway | Kong · open-source plugins plus enterprise | prompt guard, rate limiting, MCP and A2A connectivity | API-gateway-grade policy | advanced guardrails paywalled; not verified on konghq.com | [comparison](https://futureagi.com/blog/best-kong-ai-gateway-alternatives-2026/) (secondary) |
| Helicone, TrueFoundry, Bifrost | various · Helicone open source; Bifrost Apache-2.0; TrueFoundry commercial | Rust and Go proxies, observability | routing, logging | vendor benchmarks only | [TrueFoundry vs Bifrost](https://www.truefoundry.com/blog/truefoundry-vs-bifrost-ai-gateway) |
| OpenRouter | OpenRouter · commercial; $113M Series B May 2026 at about $1.3B | hosted key custody; BYOK with a fee above a volume | multi-model key holding | not a security product | [Dealroom](https://dealroom.co/news/129679-openrouter-raises-113m-series-b-hits-1-3b-valuation/) · [Sacra](https://sacra.com/c/openrouter/) |
| Claude Code managed settings | Anthropic · part of Teams and Enterprise | server-managed and endpoint-managed settings as the highest tier: `allowedMcpServers`, `allowManagedDomainsOnly`, the sandbox keys, credential masks only from trusted scopes | organisation-wide lockdown of Claude Code | settings, not the kernel: the agent's own runtime enforces them (a *setting* in ABP's terms, not a *boundary*) | [settings](https://code.claude.com/docs/en/settings) · [sandboxing](https://code.claude.com/docs/en/sandboxing) |

## 6. Secrets, workload identity, confidential computing, agent identity

What `sharness.kms` would sit beside or draw from.

| Product | Maker · licence | Mechanism | Covers | Does not cover | Source |
|---|---|---|---|---|---|
| Vault Agent Injector; Vault MCP servers | HashiCorp (IBM) · BSL and commercial; MCP servers "experimental" | a sidecar writes secrets to a shared volume as environment variables | Kubernetes secret delivery to MCP pods | the secret still lands in the agent process's environment | [ToolHive and Vault](https://docs.stacklok.com/toolhive/integrations/vault) · [HashiCorp](https://www.hashicorp.com/blog/build-secure-ai-driven-workflows-with-new-terraform-and-vault-mcp-servers) |
| AWS Bedrock AgentCore Identity | AWS · commercial | a token vault under a customer-managed KMS key; bring-your-own Secrets Manager (Jun 2026); SigV4 and OAuth inbound | per-agent, per-user credential binding | IAM Roles Anywhere integration not verified | [AWS, Jun 2026](https://aws.amazon.com/about-aws/whats-new/2026/06/agentcore-identity-secrets-manager/) |
| 1Password SDKs, Environments, Credential Broker, Agentic Autofill | 1Password · commercial | SDK fetch at runtime; a credential broker validating an OIDC token against a trust policy (public preview Jul 2026, secondary); autofill that fills without the agent seeing the credential | secrets outside the agent's context, browser agents | preview status; secondary source for the broker | [1Password](https://www.1password.dev/security-for-ai) · [blog](https://blog.1password.com/service-accounts-sdks-agentic-ai) |
| Infisical Agent Proxy; Doppler MCP server | Infisical, Doppler · open-source core; SaaS | a forward proxy on `HTTPS_PROXY` swaps placeholders for real credentials | credential brokering | Infisical: "don't currently recommend it for production" | [Infisical](https://infisical.com/docs/documentation/platform/agent-proxy/overview) · [Doppler update](https://www.plushcap.com/content/doppler/blog/doppler-february-26-product-update) |
| hoophq Cloak; OpenClaw secrets; Gravitee | various · Cloak open source | a local proxy; a fake credential pointing at localhost; the real one injected on verified TLS egress | the credential never in the agent | "does not stop a prompt-injected agent from misusing the live access" | [Cloak](https://github.com/hoophq/cloak) · [OpenClaw](https://docs.openclaw.ai/tools/secrets.md) |
| SPIFFE/SPIRE; Teleport Machine ID | CNCF; Teleport · Apache-2.0; commercial | X.509 and JWT SVIDs; short-lived certificates to agents and MCP clients | workload identity for agents (the format SHarness's session CA already uses in its SAN URIs) | identity, not confinement | [Teleport](https://goteleport.com/learn/what-is-workload-identity/) · [Palo Alto on SPIFFE for agents](https://www.paloaltonetworks.com/blog/identity-security/machine-agentic-identity-updates-august-2026/) |
| Phala Confidential AI; Anthropic's confidential inference paper; OpenAI Private Inference | Phala; Anthropic with Pattern Labs (paper, Jun 2025); OpenAI (preview, 29 Sep 2026) · commercial | TEEs (SEV-SNP, TDX, NVIDIA confidential GPUs) | protects data from the operator | does not confine the agent's own actions; Anthropic's production status not verified | [Phala](https://docs.phala.com/phala-cloud/confidential-ai/overview) · [paper](https://assets.anthropic.com/m/c52125297b85a42/original/Confidential_Inference_Paper.pdf) · [OpenAI DevDay](https://openai.com/index/devday-2026-recap/) |
| Okta Cross App Access and Agent SSO; Auth0 Token Vault | Okta · commercial | an ID-JAG token; 25+ ISVs including Anthropic (Jun 2026) | agent-to-SaaS identity | not execution | [Okta](https://okta.com/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/) · [SiliconANGLE](https://siliconangle.com/2026/06/23/okta-expands-cross-app-access-ecosystem-secure-ai-agent-connections/) |
| Microsoft Entra Agent ID | Microsoft · commercial | a first-class identity object; Conditional Access and ID Protection for agents GA Jul to Aug 2026 | agent identity governance | the Agent ID GA date itself not verified | [message centre](https://mc.merill.net/message/MC1395007) |
| Keycard, Oasis, Astrix, Aembit, Token Security | start-ups · Keycard $38M (Oct 2025); Oasis $120M Series B (19 Mar 2026); Astrix: Cisco intent to acquire, May 2026, $250M to $400M reported; Aembit $25M (Sep 2024); Token Security not verified | short-lived identity-bound tokens; just-in-time access | non-human and agent identity | not confinement | [Keycard](https://fintech.global/2025/10/23/keycard-secures-38m-to-advance-ai-agent-security/) · [Oasis](https://fintech.global/2026/03/20/oasis-security-lands-120m-to-govern-enterprise-ai-agents/) · [Astrix](https://www.networkworld.com/article/4166695/cisco-grabs-astrix-to-secure-ai-agents.html) · [Aembit](https://www.securityweek.com/non-human-iam-provider-aembit-raises-25-million/) |

## 7. Enterprise agent-security platforms: enforcement or monitoring

| Product | Status · funding or deal | Claims runtime enforcement? | Where it enforces | Source |
|---|---|---|---|---|
| Zenity | independent · $125M Series C, 3 Aug 2026, led by Norwest; $185M total | yes: "security teams can approve, modify or block agent actions dynamically" (the reporter's words, re-checked, §8); inline prevention with Microsoft Foundry; donated the Agent Control Standard to OWASP | platform API hooks, not the OS | [SiliconANGLE](https://siliconangle.com/2026/08/03/israeli-startup-zenity-bags-125m-funding-build-security-layer-ai-agents/) |
| Noma Security | independent · $100M Series B, 31 Jul 2025; $132M total | posture and "AI agent security"; enforcement claims not verified | n/a | [SecurityWeek](https://www.securityweek.com/noma-security-raises-100-million-for-ai-security-platform/) |
| Aim Security | Cato Networks (announced 3 Sep 2025; $350M to $400M estimated) | inline through SASE | network inspection | [BankInfoSecurity](https://www.bankinfosecurity.net/cato-networks-acquires-aim-security-for-ai-threat-protection-a-29350) |
| Prompt Security | SentinelOne (closed 5 Sep 2025; $133.6M cash plus shares and options per the 10-Q) | browser and gateway inline | a proxy | [SEC filing](https://www.sec.gov/Archives/edgar/data/1583708/000158370825000159/s-20251031.htm) |
| Protect AI, Prisma AIRS | Palo Alto Networks (announced Apr 2025, closed Jul 2025, about $500M estimated); Portkey being added in 2026 | "runtime security" and "AI agent security" modules | gateway and API inline | [DBTA](https://www.dbta.com/Editorial/News-Flashes/Palo-Alto-Networks-Officially-Acquires-Protect-AI-170715.aspx) |
| Cisco AI Defense (Robust Intelligence) | Cisco · expansion 10 Feb 2026; Astrix pending | "runtime protections to agentic tool use"; an MCP catalogue; an AI bill of materials | not detailed | [Cisco](https://newsroom.cisco.com/content/r/newsroom/en/us/a/y2026/m02/cisco-redefines-security-for-the-agentic-era.html) |
| CalypsoAI | F5 ($180M, Sep 2025) | inline guardrails | a proxy | [Paladin](https://www.paladincapgroup.com/?p=9140) |
| HiddenLayer | independent · $100M Series B, 2 Sep 2026 | "agentic runtime security", a coding-agent product | not detailed | [report](https://letsdatascience.com/news/hiddenlayer-raises-100m-for-ai-security-940a94e6) (secondary) |
| WitnessAI | independent · $58M Series B Jan 2026 (not verified) | inline network | a proxy | [CB Insights](https://www.cbinsights.com/company/witnessai/financials) |
| Obsidian Security | independent · $85M Series D at $1.1B, 4 Aug 2026 | "real-time runtime protection"; access controls for Claude Code and Cowork | the SaaS API side | [Pulse 2.0](https://pulse2.com/obsidian-security-raises-85-million-series-d-at-1-1-billion-valuation/) |
| Straiker | independent · $64M Series A, 29 Jun 2026; $85M total | detection-led | models | [SiliconANGLE](https://siliconangle.com/2026/06/29/straiker-lands-64m-defend-enterprise-ai-agents-attack/) |
| Cyera | independent · $400M Series F at $9B (Jan 2026); $600M at $12B (Jun 2026) | data security posture; agent monitoring | monitoring | [TechRepublic](https://www.techrepublic.com/article/news-cyera-january-2026-funding/) · [IntelliNews](https://www.intellinews.com/israeli-data-security-firm-cyera-raises-600mn-at-12bn-valuation-448033/) |
| Lasso, Apex ($7M seed, 2024), Knostic ($11M, Mar 2025), Acuvity ($9M seed, Sep 2024), Operant (not verified) | independents | mostly monitoring and MCP gateways | | [Apex](https://pulse2.com/apex-ai-security-leader-company-secures-7-million/) · [Knostic](https://finder.techleap.nl/news/feed/knostic-secures-11m-in-funding-round) · [Acuvity](https://fintech.global/2024/09/06/acuvity-launches-with-9m-to-bolster-ai-security-for-enterprises/) |

**The observation that matters for SHarness:** every platform in this table enforces, where it enforces at all, at a proxy, an API hook or a SaaS layer. None claims kernel-level, per-process confinement. The few products that name the kernel at all (Antigravity, Codex, Claude Code's sandbox, OpenShell) are the vendors' own agent products, not third-party platforms.

## 8. Standards, frameworks, reports, and a second pass on five claims

| Item | Body · date | Relevance | Source |
|---|---|---|---|
| OWASP Top 10 for Agentic Applications (ASI01 to ASI10) | OWASP GenAI · 9 Dec 2025 (date re-checked) | tool misuse, identity and privilege abuse, unexpected code execution; mitigations named by a secondary summary include least privilege, sandboxes with least privilege, deny-by-default egress | [OWASP](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026) · [Cycode summary](https://cycode.com/blog/owasp-top-10-agentic-applications/) |
| OWASP 2026 LLM Top 10; Agent Control Standard v0.1 | OWASP GenAI (ACS donated by Zenity, MIT, May 2026) · 1 to 2 Sep 2026 | a runtime-enforcement specification, an agent bill of materials, OpenTelemetry and OCSF traces; "excessive agency" rises to third | [OWASP](https://genai.owasp.org/2026/09/01/owasp-genai-security-project-unveils-2026-top-10-for-llm-applications-new-agent-control-standard-and-sponsors-as-community-tops-30000-members/) |
| NIST CAISI AI Agent Standards Initiative; SP 800-53 agent overlays; NCCoE agent identity | NIST · 17 Feb 2026; overlays drafted for late 2026 to 2027 | voluntary; identity and authorisation focus | [CSA note](https://labs.cloudsecurityalliance.org/research/csa-research-note-nist-ai-agent-standards-initiative-2026040/) (secondary) |
| CSA MAESTRO; MITRE ATLAS | CSA; MITRE · Feb 2025; ATLAS "has not yet captured many threats unique to agentic AI" | threat-modelling layers that map well onto component boundaries | [CSA](https://cloudsecurityalliance.org/blog/2026/02/11/applying-maestro-to-real-world-agentic-ai-threat-models-from-framework-to-ci-cd-pipeline) · [Balanced Security](https://blog.balancedsec.com/p/after-atlas-why-maestro-is-the-threat) |
| "Careful adoption of agentic AI services" | CISA, NSA, NCSC and partners · 1 May 2026; NCSC summary 15 May 2026 | 23 risks, 100+ practices; prompt injection "most persistent"; humans approve high-impact actions | [CSA note](https://labs.cloudsecurityalliance.org/research/csa-research-note-cisa-agentic-ai-guidance) · [summary](https://bratby.law/ncsc-agentic-ai-guidance/) (both secondary) |
| ISO/IEC 42001; EN ISO/IEC 42001:2026 | ISO; CEN-CENELEC · EN published 1 Mar 2026 | management-system certification only | [AI Act blog](https://www.aiactblog.nl/en/richtsnoeren/nen-en-iso-iec-42001-2026-informatietechnologie-artificiele-intelligen) |
| Gartner on guardian agents | Gartner · 11 Jun 2025 | "at least 10 to 15%" of agentic AI markets by 2030; later secondary citations of 5 to 7 percent of agentic spend by 2028 | [Gartner](https://www.gartner.com/en/newsroom/press-releases/2025-06-11-gartner-predicts-that-guardian-agents-will-capture-10-15-percent-of-the-agentic-ai-market-by-2030) · [IT Brew](https://www.itbrew.com/stories/2026/03/06/guardian-agents-are-here-and-ready-to-disrupt-the-market) |
| Incident survey | CSA with Token Security · 2026 | 65% of 418 respondents had at least one agent-related incident in twelve months | [Hackread](https://hackread.com/astrix-aembit-alternatives-ai-agent-identity-security/) (secondary) |

**The second pass.** Five rows a reader would lean on were re-read on their primary pages by a second agent session on 24 Oct 2026: Docker Sandboxes (all four claims confirmed, post dated 16 Apr 2026); Zenity's round ($125M, Norwest, $185M total, confirmed; the "block" wording is the reporter's); the OWASP ASI date (confirmed, 9 Dec 2025; the ASI names and mitigations are in the PDF, taken here from a secondary summary); NVIDIA NemoClaw (the overview page does **not** name Landlock or seccomp, and says enforcement "varies by host"; the table now uses the page's own words); the DeepSeek Harness CVE (the page returned 403; marked not verified). Everything else stands on the single read recorded in its row.

## 9. Where SHarness sits

**Not a sandbox product and not a guardrail: a process architecture.** Everything in §2 draws one boundary around the whole agent and leaves the agent, its tools, its credentials and its network client together inside it. SHarness's distinctive claims, all designed and none built:

1. **Per-component kernel least privilege.** Single-purpose processes (launcher, kms, net, fs, bash, llm), each with its own ephemeral uid, Landlock ruleset, seccomp allowlist, namespaces, `no_new_privs` and cgroup limits, talking only over a deny-by-default mutual TLS edge matrix issued by a session CA whose key is destroyed after issuing. The nearest analogues are OpenShell (one sandbox, not several) and Wassette (per-tool deny by default, in Wasm rather than the kernel).
2. **A KMS that never returns a clear key.** Keys sealed to one-time keys; the private key in a frozen process in a `memfd_secret` page; an empty network namespace; no filesystem rights after start. Nobody in this survey does this for agent credentials. The market's current best practice is "inject at the proxy so the agent sees a sentinel" (Claude Code's mask, Docker Sandboxes, Cloudflare, Infisical, Cloak), which still puts the clear key in a proxy process the agent can reach over loopback.
3. **A policy hash supplied from outside the agent**, layers composed by intersection, so a prompt-injected agent cannot widen its own grant. Claude Code's managed settings and Antigravity's presets are the commercial equivalents, and both are settings read by the agent process itself: a *setting* in [ABP's terms](https://riskmandate.ai/abp.html), not a *boundary*.
4. **The LLM gateway as a locked component** with a secret filter on tool results, Messages API compatible. LiteLLM, Portkey and Cloudflare AI Gateway hold keys and apply guardrails as ordinary services with full OS privileges.
5. **Transparent versus harness-aware apps.** An unmodified app gets a folder from `sharness.fs`, `HTTPS_PROXY` to `sharness.net`, a model endpoint at `sharness.llm`, a shell via `sharness.bash`; only secret handling needs code changes.

**Reuse rather than rebuild.** Landlock bindings and CLI patterns from landrun; bubblewrap as the namespace primitive, and the proxy, allowlist and credential-mask semantics from Anthropic's sandbox-runtime; Cedar for a policy language and for static analysis of grants, as ToolHive does; SPIFFE SVID formats for the per-component certificates, so identity products can consume them; OpenTelemetry and OCSF trace shapes from OWASP's Agent Control Standard, so platforms like Zenity can ingest SHarness events; Wassette for tools that compile to Wasm; Firecracker, Docker Sandboxes or Agent Sandbox as the outer boundary in topologies where the launcher runs outside the agent. The measured 3.2 ms per mutual TLS handshake and 49 ms per ephemeral user ([Evidence](../evidence/index.md)) say the per-component design is affordable.

**Direct competitors** (same job, same buyer): NVIDIA OpenShell and NemoClaw (closest in keeping credentials off the agent); Anthropic's sandbox-runtime with credential masking and managed settings (the default path for Claude Code users); Codex CLI's Landlock and seccomp sandbox; Antigravity's sandbox; Docker Sandboxes (credentials injected outside the microVM, central policy); Cloudflare Dynamic Workers (credential injection at egress); microsandbox.

**Complements** (SHarness could be their enforcement layer): the platforms in §7, which monitor and block at API hooks and would gain a kernel-enforced boundary to point at; identity products (Okta, Entra Agent ID, Keycard, Oasis, Teleport), which issue identity but do not confine; secrets managers (1Password's broker, Infisical, Vault, AgentCore Identity) as the upstream for `sharness.kms`; LLM gateways, which could sit behind `sharness.llm`; MCP gateways (ToolHive, Docker's), whose servers could run as harnessed apps; and ABP, which measures grants and would use SHarness as the control that turns an *expectation* into a *boundary*.

**Honest gaps.** Nothing is built, while the competitors ship today with daily users. SHarness is Linux-only by construction (Landlock 5.13+, TCP rules in newer kernels, `memfd_secret`), while buyers' desktops are often macOS and Windows, which Anthropic, OpenAI and Google cover with Seatbelt and AppContainer. Landlock and unprivileged user namespaces are often unavailable inside CI containers and hardened distributions. Root and kernel compromise are out of scope, whereas microVM vendors sell a hardware boundary. There is no cloud offering, no user interface, no team, no compliance story (SOC 2, ISO 42001 mapping, ACS traces), no CVE process. Several processes, a session CA and a KMS protocol are more surface than one bubblewrap profile. And the site's own caveat decides the value: "who runs the launcher decides what the locks are" ([Components](../components/index.md#sharness-launcher)).

## 10. Market signals, with numbers

- **Acquisitions, 2025 to 2026:** Protect AI to Palo Alto (announced Apr 2025, closed Jul 2025, about $500M estimated); Invariant Labs to Snyk (Jun 2025); Aim Security to Cato (3 Sep 2025, $350M to $400M estimated); Prompt Security to SentinelOne (closed 5 Sep 2025; $133.6M cash plus shares and options per the 10-Q); CalypsoAI to F5 ($180M, Sep 2025); Lakera to Check Point (closed 22 Oct 2025, about $300M estimated); Portkey to Palo Alto (intent, about 30 Apr 2026); Astrix to Cisco (intent, May 2026, $250M to $400M reported). Sources in §3, §5, §6 and §7.
- **Funding, 2025 to 2026:** Noma $100M (Jul 2025); Keycard $38M (Oct 2025); Daytona $24M (Feb 2026); Portkey $15M (Feb 2026); WitnessAI $58M (Jan 2026, not verified); Oasis $120M (Mar 2026); OpenRouter $113M at about $1.3B (May 2026); Straiker $64M (Jun 2026); Zenity $125M (Aug 2026); Obsidian $85M at $1.1B (Aug 2026); HiddenLayer $100M (Sep 2026); Reco $55M ([TechCrunch, 29 Sep 2026](https://techcrunch.com/2026/09/29/reco-raises-55m-as-ai-agent-security-startups-crowd-the-market/), whose headline says the market is crowded); Cyera $400M at $9B (Jan 2026) and $600M at $12B (Jun 2026). One blog's aggregation puts the top ten agentic-AI security start-ups at about $3.6B raised, $1.7B of it Cyera ([Software Strategies](https://softwarestrategiesblog.com/2026/03/28/agentic-ai-security-startups-funding-mna-rsac-2026/), not verified).
- **Standards:** OWASP ASI Top 10 (9 Dec 2025); OWASP Agent Control Standard and the 2026 LLM Top 10 (Sep 2026); NIST CAISI initiative (17 Feb 2026); Five Eyes agentic guidance (1 May 2026); EN ISO/IEC 42001:2026 (1 Mar 2026).
- **Platform moves:** Anthropic open-sourced sandbox-runtime (20 Oct 2025); Fly Sprites (13 Jan 2026); Cloudflare Dynamic Workers beta (24 Mar 2026); the Kubernetes Agent Sandbox post (20 Mar 2026); Docker Sandboxes (early Apr 2026); Cloudflare Sandboxes GA (Apr 2026); Foundry hosted agents GA (Jun 2026); OpenAI Private Inference preview (29 Sep 2026).
- **Incidents:** an Antigravity sandbox escape (Pillar Security, patched); a Cursor sandbox escape fixed in 3.0; the DeepSeek Harness CVE (not verified); a reported LiteLLM PyPI compromise (24 Mar 2026, not verified); 30+ MCP CVEs between January and early March 2026 (CSA).

## 11. Threats to the thesis

1. **Platforms are building it in.** Anthropic ships credential masking, domain allowlists and admin-locked sandbox settings; Docker injects credentials outside the microVM under central policy; Cloudflare injects at egress; NVIDIA keeps provider credentials outside OpenShell. A developer running Claude Code inside Docker Sandboxes with masked credentials gets much of SHarness's practical benefit today, with two vendors' support. SHarness has to show that the residual gap (a clear key reachable in the proxy, one uid for agent and tools, settings rather than boundaries) is one people will act on.
2. **Hardware boundaries may be "good enough".** The market has largely settled on a microVM per session. If the blast radius of a prompt-injected agent is one disposable VM with scoped credentials, fine-grained least privilege inside it may look like diminishing returns.
3. **Confidential computing absorbs the budget.** TEEs answer a different question (trust in the operator) but give buyers a "secure AI" story that does not involve process confinement.
4. **Agents move server-side.** Claude Code on the web, Foundry hosted agents, AgentCore, Codex cloud: when the vendor runs the sandbox and holds the credentials, the vendor has answered "who runs the launcher" and a local harness has no role. The design's [topology E](../architecture/index.md#deployment-topologies) is the same answer from the other side.
5. **Standards converge on identity and traces**, not process architecture. Procurement checklists may never ask for Landlock.
6. **Portability.** Linux-only kernel features exclude macOS and Windows desktops and many CI containers; the vendors who chose Seatbelt and AppContainer did so for reach.
7. **Complexity and trust.** With no code, no audits and no published threat-model document, early adopters have nothing to verify. The honest status labels are a strength for credibility and a weakness for adoption until the first component ships.

## 12. What this page does not claim

- It is a survey on one day by one agent session, with a second pass on five rows. Prices, round sizes and dates from secondary sources are marked as such; none is confirmed with the companies.
- It does not rank products, recommend any, or describe any platform's plans beyond what its public pages say.
- Nothing about SHarness in it is built; the comparison is between products that exist and a design.

Sources: every row's links, all read 24 Oct 2026; [sharness.ai/llms.txt](../llms.txt) and [Components](../components/index.md) for the SHarness claims; the [research note](../research/index.md) for the design review this analysis follows.