Hotcell: local sandboxes for AI agents, API keys stay on host

Hotcell addresses a practical security gap in AI agent deployment: as teams run multiple autonomous agents on shared code repositories or across cloud infrastructure, the traditional approach of embedding API keys in sandboxes creates a large attack surface. A single compromised agent environment could expose credentials for all downstream services. Hotcell's architecture flips this by keeping credentials on the host and using a gateway to mediate all outbound calls—each sandbox holds only a temporary, narrowly-scoped token that cannot be reused or transferred.

The tool's flexibility across hardware (Mac Mini, cloud VM, bare metal) and container runtimes (Docker, Firecracker, Apple VZ) reflects the reality that different teams have different infrastructure. The admission control that refuses over-subscription instead of triggering out-of-memory errors, combined with per-cell CPU/memory/cost metering, suggests the developers have thought through the operational challenge of running dozens of agents on finite hardware without cascading failures.

A limitation the documentation acknowledges: the gateway cannot protect credentials that travel outside HTTP headers (database passwords in wire handshakes, AWS SigV4 signatures signed locally, mTLS certificates). For these, developers must choose to inject the real value into the sandbox, accepting the risk. The tool also requires that SDKs read injected base-URL environment variables; those that hardcode their endpoint will bypass the gateway unless egress enforcement denies them outright.