Ona
AI-native software engineering platform
Where should an AI coding agent actually do its work?
Before anyone can change a piece of software, they need somewhere to run it: the right language runtimes, tool versions, databases and services, all switched on. For a big A single code repository that holds many projects or services together. that is rarely a matter of clone and run. It can mean installing 15 tools, configuring 3 databases, seeding test data and starting 8 services. At some companies, setting up a local environment from scratch takes days.
A cloud development environment moves all of that off the laptop and onto a machine elsewhere, which deals with environment drift, onboarding time and reproducibility. The usual way to describe one is the An open specification for describing everything a project's development environment needs, as a config file. spec, an open standard. A devcontainer.json file lists the base image, language runtimes, tool versions, editor extensions and more, so any machine can produce the same environment.
A A restricted space for running software so that whatever it does can't spread to the rest of the system. is the security half of the idea: a way of separating running programs so that failures and vulnerabilities don't spread. The name comes from a child's sandbox, a place to build, destroy and experiment without causing any real-world damage.
Further reading The last year of localhost (Ona)Sandbox (computer security) (Wikipedia)
- i.
Laptops don't scale
Say you want three agents working in parallel on a monorepo, each in its own A second working copy of the same repository, checked out on its own branch.. Each one needs its own dependency install, its own running services and its own database. You get port conflicts and shared caches corrupting each other, and teams report the laptop becoming unusable. No laptop is big enough to run five full monorepo environments at once.
- ii.
Code that only looks right
An agent that can read a codebase, and maybe compile it, still can't do much if it can't run the application or test against real services. It produces code that looks right but hasn't been tested. The gap between a diff and a pull request that's ready to merge is the development environment.
- iii.
A tenant that picks locks
Agents run arbitrary code. Containers share a kernel with the host, so one escape can reach every other container on the machine. And agents are persistent. In one test, a coding agent blocked from running a command by its A list of commands or programs an agent is not allowed to run. was told to find a way anyway. It found a path trick, and when the sandbox caught that, it asked to switch the sandbox off, explaining the evasion in the approval prompt. With dozens of approval prompts a session, that is one more "yes" in a stream of them.
- iv.
Orders hidden in data
Language models take instructions and data in the same context, so they can't reliably tell them apart. That is what makes Tricking a language model with instructions slipped into its input so it does something it shouldn't. work. An agent that reads a web page, a ticket or a file can pick up instructions someone planted there and carry them out as if they were legitimate commands.
Further reading The last year of localhost (Ona)How Claude Code escapes its own denylist and sandbox (Ona)Prompt injection (Wikipedia)
Ona, formerly Gitpod, wants to be the place where a team's software engineering agents live: task in, pull request out, with the work happening in the background in the cloud rather than on someone's laptop.
The bet is that agents need more than a sandbox. Each should get a full cloud environment with the team's tools, network access and permissions, and every run should be governed and secured down at the kernel.
Further reading Gitpod is now Ona: your AI software engineer (Ona)Ona (Ona)
- Step 1: A machine per agent
Every Ona environment runs in its own virtual machine, with its own kernel, memory space and network stack. An agent that compromises one VM can't reach the others.
- Step 2: Environments that build themselves
Environments are defined with Dev Containers, plus an automations file that lists long-running services, such as databases and dev servers, and one-time tasks like installing dependencies or migrating a database. An agent's environment boots, starts everything it needs, seeds test data and is ready to work with no manual steps.
- Step 3: Inside the network
Environments can run inside the customer's own A virtual private cloud: a company's own walled-off network inside a cloud provider., with the same network access a developer would have. So an agent can query the databases, hit internal APIs and run the full test suite against staging. When it opens a pull request, it has run the same tests, linters and build a human would.
- Step 4: Block by content
Common runtime security tools identify programs by their path, so blocking one is easy to dodge: copy it somewhere else under a new name. Ona's Veto hashes each binary's contents with SHA-256 at the kernel and blocks it by what it is, whatever it is called.
Further reading The last year of localhost (Ona)How Claude Code escapes its own denylist and sandbox (Ona)
How do you contain something that reasons about its cage?
Runtime security tools were designed for workloads that don't try to evade monitoring. Even with content-based blocking in place, the agent in that test found a way round by invoking the dynamic linker directly, a class of evasion that no current evaluation framework measures.
How much access is too much?
An agent's output tracks the context it can reach, and one inside the company network can read code, query databases and hit internal APIs. The same reach raises the stakes of indirect prompt injection, where instructions hidden in content an agent retrieves may be executed as legitimate commands.
Further reading How Claude Code escapes its own denylist and sandbox (Ona)The last year of localhost (Ona)Prompt injection (Wikipedia)
Ona is an AI-native platform for software engineering, designed to act as a mission control center for agentic development workflows. Rather than focusing on an IDE, Ona enables teams to deploy AI agents that decompose tasks, write code, review changes, and generate documentation across large production codebases.
The company was originally founded as Gitpod, a cloud-based development environment with strong developer adoption. In 2025, the team executed a substantive pivot and rebranded to Ona, shifting its focus toward AI-native software engineering as the center of gravity moved from tools to autonomous workflows.
Ona is built for engineering teams who want AI to operate as a full participant in software development — not just as an autocomplete tool, but as something that can be handed a task and trusted to see it through.
- monorepo
- A single code repository that holds many projects or services together.
- Dev Container
- An open specification for describing everything a project's development environment needs, as a config file.
- sandbox
- A restricted space for running software so that whatever it does can't spread to the rest of the system.
- git worktree
- A second working copy of the same repository, checked out on its own branch.
- denylist
- A list of commands or programs an agent is not allowed to run.
- prompt injection
- Tricking a language model with instructions slipped into its input so it does something it shouldn't.
- VPC
- A virtual private cloud: a company's own walled-off network inside a cloud provider.