Security tools are very good at telling you what is wrong. Then the ticket waits for a human, the human waits for a sprint, and the CVE ages while everyone agrees it matters.
A Pix Sandbox changes who picks up the ticket. It is a Belai machine that Vulnetix runs on its own Cloudflare container, all day and all night. You choose the repositories it clones and the toolchains it installs, then start sessions, agents and crews from the same console pages you already use. Everything it does passes the same guardrails as your own laptop would, plus three firewalls that only a managed machine can give you.
Every agent action passes four gates before it reaches your repository: a System One decision model on every call, the AI Firewall on model calls, the Package Firewall on installs, and egress on every host.
From a row in the queue to a fix you can prove
Every finding in Vulnetix already carries the evidence that decides urgency: four KEV catalogues, exploit maturity across 20 sources, EPSS and Coalition ESS, reachability, end-of-life dates and the Safe Harbour version that is clean on all four axes. Hand that finding to a sandbox and the crew starts from that evidence. Your own risk prioritization strategy orders the queue. Safe Harbour picks the closest version free of vulnerabilities, exploits, malware and end-of-life, and the Package Firewall agrees with it at install time. A campaign only counts an item finished when a later scan of the same repository confirms it, and the VEX and SARIF evidence travels with the PR.
Four ways teams put a sandbox to work
Data-quality-driven remediation
Open any finding, campaign or KEV entry and send it to a sandbox. The security crew of vuln-scout, two patchers and a verifier works it to a draft PR, with Safe Harbour versions and VEX written by the harness.
Security agents, 24/7
Schedule worker profiles on cron. Scan overnight, triage at dawn, watch new KEV entries every fifteen minutes. Nothing depends on a laptop staying awake, and every run lands on the shared kanban board.
Code review every pull request
The sandbox follows your repositories' pull requests: review state, conflicts and kanban cards. Run /vulnetix review across nine scanners, have an agent verify every finding, and get a report of what was fixed and what needs you.
Whatever you can imagine
Import an agent from about 80 other harnesses, pull a crew from the registry, or have the builder draft one from a premise. Dependency upgrades across every manifest, incident playbooks, compliance bundles and migration sweeps all run while you sleep.
Every sandbox session leaves a trail in the console. Pix reads the finding, the SBOM and the audit log beside it, so the explanation for a fix is one question away.
What the big AI labs can't give an agent
A model's knowledge stops at its training cutoff, and the intelligence never stops arriving. Since a model was trained there have been new CVEs and KEV listings, packages that turned malicious, public exploits, end-of-life dates, vendor patches, EPSS rescores, fresh enrichment and new detection and WAF rules. A Pix Sandbox gives the agent live tools over that stream as reconciled records, so it reasons with today's intelligence.
Belai computes a repo map for every session: paths, detected commands, test suites and git metadata, with no file contents. The Tech Stack Graph adds what your scans already know, linking repositories, packages, languages, services and the findings on each. Together with the scanner output Belai indexes for search by meaning, that gives the agent a retrieval graph over your whole estate.
| For an agent doing security work | Pix Sandbox | A big-lab coding agent |
|---|---|---|
| Intelligence published after the training cutoff | Live tools over 160 reconciled sources | Training snapshot plus web pages |
| Exploit maturity, KEV, EPSS and Coalition ESS on every finding | Yes | No |
| Malware and exploitable versions refused at install time | Package Firewall on every package manager | No |
| Upgrade target chosen for safety | Safe Harbour, scored on four axes | Usually the newest version |
| Context across your estate | Repo map, Tech Stack Graph and indexed scan output | The files in one checkout |
| Machine you can verify | Reproducible image, SBOMs, signed provenance, evidence pack | Not published |
| Choice of model | 13 providers through your own keys | The lab's own models |
| Security review priced as an extra | No. The scanners and review are free | Often a premium tier |
Already happy with your agent? The same intelligence works inside 40+ harnesses. Our Agent Skills and the MCP server bring the live database, the dependency guard and the security workflows into the agent your team already runs, at no cost. See the agent guides.
Safe enough to leave running while you sleep
Every way into the model and every way out of the machine has a gate, and every gate fails closed.
The key never enters the machine
The sandbox holds a placeholder. The Cloudflare edge checks the request belongs to this sandbox and swaps in the real key for that one call.
Egress you can see
The container starts offline. Log mode counts every host while you learn; deny mode refuses all but your list. An SDK phoning home shows up as a host you never asked for.
Sealed context
Every block of context carries a nonce and a hash. Tool output is cleaned and classified before the model sees it, so instructions hidden in a README stay text.
A judge for every call
A System One decision model reads each tool result and approves each risky action before Belai acts, and it is included at no charge.
Malware stops at install
Every package manager points at the Vulnetix Package Firewall, which refuses known malware and exploitable versions before a byte downloads, whichever agent asked.
An image you can verify
A pinned Nix flake built twice to the same hash, CycloneDX and SPDX SBOMs, SLSA provenance signed with cosign, and a hash check of every binary before Belai starts.
An evidence pack per launch
One zip per running instance: a CycloneDX document, a plain-language PDF and SHA256SUMS, stating what ran and how each check turned out.
Nothing to steal
The metadata address answers with safe facts and never a credential. Private repositories clone with a short-lived, read-only token from the Vulnetix GitHub App.
Quality of life
Every one of these ships in Belai and is tested in its repository, and on a sandbox they are already set up: sessions from the browser, one shared kanban synced both ways with GitHub issues, moving a session between laptop and sandbox, token budgets, a post-end test pass, one commit per goal, the diff in the approval prompt, search by meaning, a System One decision tool for agents, session intelligence, Markdown export and launch configurations.
Sizes and the trust stack
Small, Medium or Large, every sandbox ships the same trust stack.
- Small, $85 USD per month: 1 vCPU, 4 GiB, 1 web session, up to 7 agents, 20 GB disk.
- Medium, $180 USD per month: 2 vCPU, 6 GiB, 2 web sessions, up to 14 agents, 20 GB disk.
- Large, $350 USD per month: 4 vCPU, 12 GiB, 4 web sessions, up to 28 agents, 20 GB disk.
Jev and Clef
Jev from TypeSafe and Clef from Cloudflare are the System One models that approve every tool call. Clef answers through Workers AI with no key on the machine, and Jev is one launch setting away, included.
Nix and NixOS packages
The image is built with Nix from one pinned NixOS package set. It cannot drift, rebuilds to the same hash, and installs language packs only as signed closures.
Cloudflare Sandbox
Each sandbox is its own Cloudflare Sandbox container, on a platform that carries independent SOC 2 Type II and ISO 27001 attestations.
bubblewrap and Landlock
Every shell command runs in bubblewrap namespaces, or under Landlock where namespaces are unavailable. A repository can tighten the sandbox and never loosen it.
Sealed context and PII masking
Tool output is sealed and classified before the model reads it, and the AI Firewall blocks secrets and masks PII before a prompt leaves.
AWS KMS vault
Provider keys and secrets are encrypted with AWS KMS in the Vulnetix vault. The sandbox only ever holds a placeholder.
Package Firewall and live IoCs
Every package manager goes through the Package Firewall, backed by malware indicators refreshed every 15 minutes.
Every package in a Pix Sandbox is listed in CycloneDX and SPDX SBOMs and pinned by a lock file. The image meets SLSA v1.0 Build Level 2 and is reproducible: it is built on GitHub-hosted runners, built twice, and shipped only when both builds give the same hash. The build signs an in-toto SLSA provenance statement for the registry digest with Sigstore keyless signing, verifies it with cosign before publishing, and publishes the SBOMs and the bundle through the Transparency Exchange. Open Vulnetix/pix-sandbox in TEA Explorer or list every image release via the TEA API.
Vulnetix is a Global CVE (GCVE) Numbering Authority, GNA 110. We issue vulnerability identifiers, run a coordinated disclosure programme and publish every record in public.
Give the ticket to someone who never sleeps
Choose your repositories and languages, launch, and send it your first finding. Read the full feature tour →