Docs
Protect your keys from tricked Claude bots
If a web page, a file or another bot talks Claude into misbehaving, it still can't read your sign-ins or keys, because it works in a sealed box with no internet that sees only the task folder. It can't go online by itself either: anything it does outside the box goes through kwant's own tools, under the bot's approval settings. Your real sign-in stays outside, and kwant passes on only Claude's model calls. In the app the switch is under the VM card in Settings › All spaces › Computer (it was called Run Claude inside the VM in 0.7.7). It's off by default and works on Linux.
Turn it on
- Open Settings → All spaces and find the card Computer for browsing and commands.
- Pick VM. Docker has to be running.
- Turn on Protect your keys from tricked Claude bots. It switches right away, with nothing to save.
Turning it on the first time sets up Claude's VM once: the Claude chip says Getting ready while kwant downloads about 860 MB, which takes a few minutes. A reply sent meanwhile says so and asks you to try again, and nothing runs on your computer instead. Turning the setting off lets Claude reply on your computer while the setup keeps going.
- Linux only in 0.7.7. On a Mac the switch is greyed out with "Coming to Mac later".
- Claude only. Codex and Grok still run on your computer, and their chips say "Not isolated yet".
- Claude sign-ins only. A Claude API-key or Custom account still runs on your computer. Its chip says "Not isolated".
- Local mode: the setting is kept but does nothing, and the chip says "Not isolated".
- Docker stopped: the switch is greyed out with "Start Docker to turn this on". If it was already on, you can still turn it off.
What it protects
A Claude bot that has been talked into misbehaving, by a web page, a file or another bot's text, can't do these things while it runs inside the VM:
- Read your sign-ins or keys. Your
~/.claude,~/.codex,~/.grokand~/.sshfolders, kwant's data folder and the sign-in homes are never mounted. The container gets a stand-in key, and the real one stays with kwant. A bot folder that is, holds or sits inside one of these is refused before the container starts. - Send your key or files anywhere. The container has no network. kwant passes on only Claude's model call and refuses everything else, including Anthropic's server-side tools.
- Run up an unbounded bill in one reply. Each reply may make 200 model requests. The next one is refused, and the chat says the reply hit its limit.
- Leave a trap for kwant on your computer. kwant notes every folder an isolated reply used. In such a folder, Claude on your computer starts without the folder's own hooks and MCP servers, Codex and Grok don't start at all, and command checks that point into the folder are refused. kwant reads these folders without following links, so a swapped folder can't point a read somewhere else.
What it doesn't protect against
- Spending your credits. The bot uses your real Claude account through kwant. The request limit bounds one reply, not a day of replies.
- Actions through kwant's own tools. kwant's browser, shell, files, teammates and approvals still work for the bot, as they do without isolation. They follow each bot's approval settings, so a bot that may run commands without asking still can.
- kwant's built-in shell. It runs in kwant's own VM container, which keeps its network.
- Files you run later. A bot can still write git hooks,
.envrc, package scripts or editor tasks in its folder. They run if you use them on your own computer. - Codex, Grok, and Claude API-key or Custom accounts. They run on your computer as before.
- A Docker or kernel escape. The container drops every capability and runs as your user with a read-only root and no network, but it shares the kernel.
What changes for the bot
- No WebSearch or WebFetch. Those reach the network from Anthropic's side, so they're off. Bots use kwant's browser tools instead.
- Only kwant's own MCP servers. Outside servers, such as Notion, are left out of isolated replies because the container can't reach them. They still work with the setting off.
- A new session. The first isolated reply starts a fresh Claude session. Later replies carry on from it.
- Two at once. Two isolated replies run at a time. The next one waits its turn, and the chat says it's in line.
When it can't run
With the setting on, any problem stops the reply with a card in the chat, and nothing runs on your computer instead. The card says what happened and what you can do. Turning the setting off is always up to you.
| The card says | What to do |
|---|---|
| Claude's VM is still setting up, or its download failed | Wait and try again. The next reply retries the download. |
| Docker isn't running | Start Docker, or turn the setting off. |
| The bot's container didn't start, or stopped partway | Try again. If it keeps failing, turn the setting off and check Docker. |
| No Claude sign-in, or it expired | Sign in to Claude again. |
| The folder is private | Give the bot a folder that isn't your home, a sign-in folder, kwant's data or Docker's folder. |
| Codex or Grok was asked to work in a folder an isolated Claude used | Use another folder for Codex or Grok. |
| kwant runs as root | Run kwant as a normal user. The container never runs as root. |
Server settings
In <data>/config.toml:
[agents_in_vm]
request_limit = 200 # model requests per reply (env KWNT_AGENT_REQUEST_LIMIT)
memory_mb = 1024 # per bot container (env KWNT_AGENT_MEMORY_MB)
max_turns = 2 # isolated replies at once (env KWNT_AGENT_MAX_TURNS)Who refreshes a sign-in
While the setting is on, kwant is the only thing that refreshes a bot's own Claude sign-in. It never refreshes your computer's own Claude sign-in: when that has expired, the reply stops and asks you to sign in again on your computer.
Known issue in 0.7.7
Undo points saved by kwant 0.7.6 or earlier in a folder reached through a linked (symlinked) parent folder can't be restored in 0.7.7. kwant refuses safely and changes nothing. New undo points work.