Introduction

VPN Works is the VPN, rebuilt as an operating system. Its kernel, vpnw, gives each program its own network: one way out, a policy you can read, a path you choose, and a record of every connection. Plugins are its apps.

AI agents, scrapers and build jobs run on their own now, usually with all the network access the machine has. That’s a lot of trust for a program that follows instructions it finds in text. A README or an issue only has to carry the right sentence, and an agent holding a token can be talked into sending it out. Models can’t reliably tell data from instructions, so the practical defense has to sit outside the model.

A VPN or a firewall doesn’t fit that job. A VPN gives the whole machine one way out. A firewall can’t tell which program opened a connection. Neither keeps a record of what one program did. VPN Works works one level down.

Before: one VPN for the whole machine, one path and one set of rules for every program, and no record of which program sent what. After: the program sealed in, with vpnw as its one door, each connection checked, routed and recorded, and the rest of the machine untouched.

Four Things, Per Program

One way out. On Linux the program runs sealed in a network namespace with nothing but loopback. Its only door is vpnw. A program that ignores proxy settings doesn’t leak around it; it gets no route at all.

A path you choose. Straight out, a SOCKS or HTTP proxy, a proxy over TLS with failover, or a WireGuard tunnel that vpnw runs itself, without root. For this program only.

A policy people can read. A short text file, drafted from a real run by the Learn plugin, read and fixed by a person, then enforced.

A record. Every connection with its decision, as text while it runs and as JSON Lines for other tools.

Built Like an OS

The kernel does those four things and nothing else. Paths are its drivers. Everything around them is a plugin: a WebAssembly module in a sandbox with no files and no network, that reaches the kernel only through the calls its manifest asks for, the way an app uses system calls. The console you read is a plugin, Trace. Policy drafting is a plugin, Learn. Guard plugins can refuse what the policy allowed, and fail closed if they break. Tunnel plugins hand the kernel WireGuard configs to rotate through. The platform · Plugins

Where It Stands

Version 0.8.0, out October 14, 2026, for Linux and macOS. In the project’s tests a sealed program tried 17 ways around vpnw, IPv6 included, and every one was blocked. WireGuard tunnels handled 36 of 36 faults Lab threw at them, run directly and through the rotate plugin. An exit refused all 11 forbidden requests a client sent straight to it with a valid token. And 236 of 236 tests passed, including runs of the real binary through real WireGuard tunnels. Every figure comes from one script in the code repository. How it was tested

What it doesn’t do yet: seal programs on macOS, carry UDP, limit files, or cover a whole network at once. Those are on the roadmap.

Try It

Five minutes on a Linux machine: the quick start. Or a few commands that show it working: See It Run.