Your agent's VM loses LLM access on purpose: boxery 0.9 changes the rules

An upgraded agent VM that can no longer call its model may be behaving exactly as intended. boxery 0.9.0, published November 2 at 18:18 UTC, stops automatically sharing every configured LLM provider with its virtual machines. Access now requires a grant for each provider and VM.

boxery gives an existing coding harness disposable Ubuntu environments with shell, file, browser and desktop tools. It connects through MCP or a native Pi extension; the model provider remains separate. The new boundary matters when agents run inside those environments, rather than merely controlling them from a laptop.

Ask for access, then wait for a person

The documented command boxery grant demo llm:chatgpt enables one provider for one VM. OpenAI, Anthropic and Ollama have separate grant names. According to the release, revocation takes effect on the next request.

A new vm_grant tool lets an agent request GitHub, SSH-agent, environment-variable or file access. The project says the approval prompt comes from boxery and cannot be answered by the requesting agent. Clients without the required prompt support instead receive a command to pass to the user. Agent-requested grants exclude boxery’s own configuration and sensitive directories such as ~/.ssh and ~/.pi.

The distinction between grant types is consequential. The documented LLM and HTTP proxy routes keep real credentials on the host, while explicitly granted environment variables or files can be read by software inside the VM. This is an access-management design, not proof that arbitrary agent code is harmless.

Upgrade the host first

The release instructs existing users to upgrade the host before controllers, grant providers again, and update scripts for renamed tool parameters. Already-running libvirt VMs retain their previous open network until stopped and started; installing the release alone does not apply that isolation to a running guest.

The setup requires Node.js 22.13 or newer on the laptop and host. The npm package is boxery-vm; MCP setup uses npx add-mcp boxery-vm, while Pi uses pi install npm:boxery-vm. Hosts run on macOS or Linux. Users supply their existing model authentication or API credentials and pay their provider’s costs; the experimental boat.dev backend requires a paid plan.

There are practical rough edges. A November 3 user report describes VM creation failing on a remote macOS host with fnm-installed Node because a noninteractive SSH session lacks the expected executable path. That report is a specific compatibility limitation, not a security audit. AITrending has reviewed the release, tagged documentation and issue, but has not installed or independently tested the isolation claims.