Give every AI agent
its own computer.
An operating system built to perfect the work of autonomous agents: they operate programs, write code and pipelines, fill in forms, make your job easier. And because every session is sealed inside its own virtual machine, your system and your data stay protected.
The agent OS that is actually an OS
Most products called an “agent OS” are apps or cloud services running on top of an ordinary operating system. Brainbox is the operating system itself: you install it on a computer, and it takes over the whole machine. It was built from the ground up for one purpose - running AI agents - and every release improves it for that purpose and nothing else.
What your agents can actually do
The point of the wall is not to shrink the agent - it's what makes real autonomy safe to grant.
Operate a real computer, not just a chat box
Each session is a genuine Linux machine with a desktop the agent can use - browse, click through applications, run and debug code. Watch over its shoulder from the portal or take the controls yourself. Close the laptop: sessions live on the box, and the work continues.
Sealed and empowered at the same time
An own display server (phantom) lets agents drive graphical programs from the pre-AI era - documents, real applications, GUI-level work. The session monitor mediates what runs down to the system-call level; a media server moves files in and out on your terms.
Talk to it, and let it talk back
A question out loud, an answer out loud - speech recognition runs locally on the box (Whisper), so the voice lane needs no cloud. The voice comes from the box, your phone, or your Home Assistant speakers. With a local model, nothing leaves the building.
Bring your own brain - keep your account
Connect your Claude/Codex/… account - or a local model such as Ollama - once in the wizard. It stays on the box and never passes through anyone else. Centralise accounts, or let each member bring their own.
Real jobs, at real scale
Several boxes share one workload - that's how doesitreproduce.com re-runs thousands of published analyses on a fleet of these same boxes, today. Any computer joins: laptop, NAS, Raspberry Pi.
Your household's, and reachable from everywhere
Member accounts for the people you live or work with; English and German built in. Telegram and the hardened relay client keep work reachable when you're out; thin clients for Windows and Linux for everyone else.
Why you can hand an agent that much power
One design decision carries all of it: every session runs in its own virtual machine, with its own kernel. Shield and workshop are the same wall.
Prompt injection - hidden instructions smuggled in through what an agent reads: a supplier's PDF, a web page, a calendar invite - can't be filtered away reliably; anyone who claims otherwise is guessing. Meta put it plainly: “a fundamental, unsolved weakness in all LLMs.” And it is only one entry on the list - agents also mis-run commands, delete the wrong thing, and get talked past their own allowlists.
So Brainbox assumes a session will eventually be tricked, and makes that a non-event. A compromised session is trapped in its own disposable machine: it can't reach your files, your network, your other sessions, or your AI credentials - those are attached at a broker on the boundary, so the session never holds them. You delete the machine, and the problem is gone with it. The same wall works in both directions: because the session is genuinely sealed, it's safe to hand it a full userland, a graphical desktop, and power down to the system-call level.
Read the reporting
Don't take this page's word for it. Freely readable coverage from serious outlets - this is the state of play:
- Samsung bans use of generative AI tools like ChatGPT after April internal data leak TechCrunch · May 2023 - engineers pasted confidential source code into a chatbot
- “EchoLeak” AI attack enabled theft of sensitive data via Microsoft 365 Copilot SecurityWeek · June 2025 - the first zero-click attack on an AI agent: one crafted email, no interaction needed
- Malicious Nx packages in “s1ngularity” attack leaked 2,349 GitHub, cloud, and AI credentials The Hacker News · August 2025 - malware turned victims' own AI assistants into credential-stealing tools
- UK intelligence warns AI “prompt injection” attacks might never go away The Record · December 2025 - the NCSC says the flaw is structural, not a bug to patch
- AI agents can escape sandboxes without ever breaking them CSO Online · July 2026 - agents “follow every rule” and still reach outside their sandbox
It is already doing real work
Does It Reproduce? re-runs published biomedical analyses autonomously - reads the paper, fetches the data, re-runs, scores. Months of unattended operation on a fleet of these same boxes: Brainbox's first serious workload and its toughest test.
Explore the reproductions → - figures read live from the project, each time this page is served.
Install it
Brainbox is the operating system - it doesn't install alongside Windows or Linux.
- Download the installer: brainbox-installer-amd64-1.0.0.iso (~2.9 GB) - verify it against its SHA-256 if you like.
- Boot it on a machine or VM with an empty disk of at least 16 GB. Agent sessions run as real virtual machines, so the host must allow hardware virtualisation - Intel VT-x or AMD AMD-V (on by default on most PCs; inside a VM, enable nested virtualization).
- Let it write Brainbox to the disk and reboot into it. Remove the ISO.
- Claim it: the box shows its address, a QR code and a one-time setup code on its own screen. Open the address in a browser on the same network and follow the wizard - the setup code proves you're the one standing at the box.
Prefer reading first? The complete source, including the isolation layer, is at github.com/schlein-lab/brainbox.
Straight answers
The questions that decide whether this is for you.
What do I need to run it?
A machine of your own: a spare x86 box, or a VM on your NAS or hypervisor - with hardware virtualisation (VT-x/AMD-V) and an empty disk of 16 GB or more. The installer ISO is above. You operate everything from a browser. A Raspberry Pi can join as a portal, voice and fleet node; agent sessions need x86.
What does it cost?
Nothing, for noncommercial use - the software is free under PolyForm Noncommercial 1.0.0, and it runs on hardware you already have. No subscription, no metered billing. Commercial use requires a separate license.
Where does the AI model run?
Brainbox is the infrastructure underneath agents, not a model host. You bring your own model access - a local model if your hardware carries it, or your existing provider account. Either way, a session reaches the network only where its egress policy allows.
Can it work with confidential files - client records, patient data?
That decision stays yours, and so do the files: workspaces live on your machines, each session is sealed off from the others, and what a session may send out is set by policy, not by the agent's goodwill. Two limits belong in the same breath: whoever administers the box can reach a session's contents - the isolation is between sessions, not against the operator - and one box is one owner today, so do not put two parties who must not read each other on the same machine. Germany's Federal Bar recommends AI providers with servers in Germany or Europe - one server location passes every test: your own.
Can I stop an agent before it does something I did not intend?
You can bound it in advance and you can stop it - but you cannot yet make it ask. Bounding is real: the network rule, the work volume and the quota of a session are set before it starts and enforced outside it. Stopping is real: halt or destroy the session from the start screen and the microVM goes with it. Deleting a session or removing a device asks for a second factor, and that gate is fail-closed - if the factor cannot be confirmed, the action is sealed rather than allowed. What is not built yet is a step that pauses by itself mid-run and waits for you. An agent can raise a question; nothing makes it stand still. If your use depends on that, wait for it - we will say when it lands.
Is Brainbox certified?
Brainbox claims no certifications, and this page makes no compliance promises. What it changes is simpler: processing happens on machines you own, so the question “where is our data?” has a one-word answer - here.
What we do not claim
The gaps our own source tree records against us - before you find them.
- No approval gate on the agent's own steps. Nothing pauses mid-run and waits for you. The second factor on destructive actions - deleting a session, removing a device - is real and fail-closed; one on an agent's own next step is not there.
- One box, one owner. Additional accounts get their own screen, not their own tenant. Do not put two parties who must not read each other on one box.
- Not blind to its own administrator. The isolation is between sessions, not against the operator.
- The Raspberry Pi image has no session cells yet. There the box is a portal, voice and fleet node; agent sessions need x86 with VT-x/AMD-V.
- Hypervisor isolation is code, and code has bugs. “Much harder to break out of” is honest; “impossible” is not.
Each line maps to a named file in the repository, so you can check that we are still telling the truth.
Stay in the loop
The source is open and the installer ISO is out. Leave your address and we'll write when a new release lands - nothing else.
License
Brainbox is published under PolyForm Noncommercial 1.0.0: free to use, study, modify and share for noncommercial purposes. Commercial use requires a separate license - planning one? Write to support@brainarbeit.com. Project names and logos are not covered by the code license.