Roadmap on VPN Works

Introduction

Tue, 29 Sep 2026 00:00:00 +0000

A VPN for every agent: each AI agent gets a network of its own, and every connection it makes is checked, routed and recorded.

VPN Works is a project to build that network. Its engine, vpnw, is one small program. It runs an agent in a sealed sandbox whose only way out is vpnw, then decides each connection with a policy you can read, sends it down the path you chose and writes it down.

How It Works

Tue, 29 Sep 2026 00:00:00 +0000

The idea. Seal each agent in a sandbox whose only way out is vpnw. vpnw checks every connection against a policy, sends it down the path you chose and records it. The agent doesn’t need to know any of this.

A VPN usually works at the level of the machine. Once it is up, every program on the machine goes out the same way, under the same rules, and nobody can say afterwards which program sent what. That was fine when the programs were a browser and a mail client. It fits badly when one of them is an agent that takes instructions from whatever it reads.

Next Uses: Seven Places Where a Network per Program Could Fit

Tue, 29 Sep 2026 00:00:00 +0000

The four case studies share one pattern. A program that runs on its own, and can be talked into things, gets a network of its own: one way out, a path chosen for it, a policy a person can read and a record of every connection. Coding agents came first because they are the clearest case, and because the Alpha demo covers them.

The pattern turns up well beyond coding agents. None of the seven uses below has been tested, and none is a goal of the Beta, though some would reuse pieces the Beta builds. This post sets out what each would ask of vpnw, what already carries over from the Alpha, and what would be new work. It is a map for choosing what to try after the Beta, ideally with the people who run these systems.

The Next VPN Works Prototype: A 14-Week Beta That Puts Real AI Agents Under vpnw

Tue, 29 Sep 2026 00:00:00 +0000

The Alpha answered one question. Can a small program seal an AI agent in and control every connection it makes? On Linux, on one machine, with a stand-in agent, the answer was yes. The next prototype, the Beta, takes on the harder question: does it hold up with real agents doing real work, on the machines where agents actually run?

The Beta is planned at about 14 weeks with two or three people. It keeps the same engine and the same four commands: run, trace, guard and learn. What it adds is what real use needs, from a WireGuard route and limits on files to more systems and packages that install in one step. Then three coding agents that developers use every day work under it for four weeks.

Where the Money Is in VPN Works: One Policy and One Log for Every AI Agent a Company Runs

Tue, 29 Sep 2026 00:00:00 +0000

VPN Works is a prototype today, so its business case is a plan to test with customers. Here is the short answer to where the money is. The engine that seals one agent on one machine is the part that earns trust. The money comes from companies that run many agents and need one policy and one log across all of them, on every laptop, CI runner and server, plus exits they control. That’s worth a monthly fee per developer. There’s also a faster route: over the past year, security and network vendors paid between $180 million and $400 million each for AI and agent security startups.