Agent Runtime Sandboxes & Code Execution

Parent: AI Agent Ecosystems · researched 2026-06-03T22:51:13.126Z· 27 sources · 12 concepts · skill agent-runtime-sandboxes

Secure, ephemeral cloud environments where an AI agent runs LLM-generated code, uses a computer,

Agent Runtime Sandboxes & Code Execution

Secure, ephemeral cloud environments where an AI agent runs LLM-generated code, uses a computer, [source]
or executes tools - provisioned by SDK/API in milliseconds-to-seconds, isolated from your host and [source]
other tenants, and torn down (or snapshotted) when the task ends. This skill is the **agent-facing [source]
SaaS/SDK layer**: which managed sandbox to pick and how to drive it (create / exec / files / [source]
snapshot / fork / egress policy). The kernel/OS isolation mechanics it sits on top of live elsewhere. [source]

When to use / Skip

Use when you are choosing or wiring a managed sandbox to run untrusted or model-generated code: [source]
"where should my agent run the code it wrote", picking E2B vs Modal vs Daytona vs Cloudflare, [source]
SDK calls to create/exec/upload/snapshot/fork a sandbox, configuring network egress for an agent, [source]
GPU sandboxes for ML agents, MCP-in-a-sandbox, or comparing latency/pricing/limits across providers. [source]
Skip - kernel/OS isolation primitives go to devops-linux-internals -> Linux Sandboxing & Confinement [source]
(seccomp-bpf, Landlock, gVisor internals, Kata Containers, Firecracker internals, cgroups v2 & [source]
namespaces). That peer reference explains how the isolation layers work; this skill names them only [source]
as a selection criterion and points there for mechanics. Also skip: the general agent-guardrails / [source]
prompt-injection topic (Dual-LLM, CaMeL, OWASP-LLM as a subject in its own right) -> [source]
ai-agents-orchestration (references/agent-reliability-and-guardrails.md) - this skill covers the trifecta [source]
only as it bears on where agent code runs; building an agent loop/harness -> ai-agents-orchestration; [source]
MCP server authoring -> ai-mcp-sdk-prompting; generic container/CI build -> devops-containers-cicd. [source]

Why agents need sandboxes

LLM-generated code is untrusted by construction. A model can emit rm -rf, an infinite loop, [source]
a fork bomb, a crypto-miner, or a package install that runs a malicious post-install script - not [source]
maliciously, just because it pattern-matched. You cannot run that in your app process or build host. [source]
The lethal trifecta (Simon Willison, Jun 2025). An agent becomes exfiltration-ready when it [source]
combines **(1) access to private data + (2) exposure to untrusted content + (3) the ability to [source]
communicate externally**. With all three, a prompt-injection payload hidden in fetched content can [source]
read your secrets and POST them to an attacker. A sandbox is the blast-radius container for #1 [source]
and the egress chokepoint for #3 - but it does not by itself break the trifecta (see Security). [source]
Isolation / multi-tenancy. One user's (or one agent task's) code must not see another's data, [source]
files, or network. MicroVM/gVisor boundaries give VM-grade separation that shared-kernel containers [source]
cannot guarantee against a determined escape. [source]
Reproducibility & determinism. Declarative images + snapshots/templates pin an exact [source]
environment (OS, packages, files) so the same agent run is reproducible, forkable for parallel [source]
exploration, and rollback-able after a risky operation. This is the property that turns "run some [source]
code" into a controllable, restartable workflow. [source]

The managed-sandbox landscape

Isolation tech is a first-order selection criterion (see devops-linux-internals for how each works): [source]
Firecracker microVM (E2B, Vercel, Fly, CodeSandbox) = strongest, dedicated guest kernel; [source]
gVisor user-space kernel (Modal; Northflank cloud default) = strong + GPU-friendly; [source]
hardened OCI/Docker (Daytona, also offers Kata/Sysbox) = fastest start, smaller attack-surface cut. [source]

Tier 1 — full SDKs, build your patterns here

E2B - Firecracker microVMs; the agent-coding default. Python (e2b, e2b-code-interpreter) & [source]
JS/TS (e2b, @e2b/code-interpreter) SDKs; partially open-source, self-hostable via Terraform on [source]
AWS/GCP. Same-region start ~150 ms (vendor; see contested numbers below). Sandbox exposes [source]
.commands, .files, .git, .pty; the Code Interpreter adds stateful runCode()/run_code(). [source]
Native pause/resume (filesystem and memory - running processes & variables survive) and [source]
snapshots (one snapshot -> many sandboxes). Limits: 1 h continuous (Hobby) / 24 h (Pro), 20 / 100-1100 [source]
concurrent, 8 vCPU·8 GB (Hobby). Per-second pricing: vCPU $0.000014/s, RAM $0.0000045/GiB/s; $100 [source]
free credits, Pro $150/mo. Built-in MCP gateway -> 200+ Docker MCP Catalog tools. [source]
Modal - gVisor (per benchmark blogs); Python-first (Go/JS in beta), autoscales 0->20k+ sandboxes. [source]
modal.Sandbox.create(...) takes gpu=, cpu/memory, block_network, outbound_cidr_allowlist, [source]
volumes, encrypted_ports. .exec() returns a ContainerProcess (streamed stdout/stderr). [source]
GPU is first-class (A100/H100/T4) - the standout. Two snapshot kinds: filesystem snapshots [source]
(snapshot_filesystem() -> a reusable Image, stores only the diff) and memory snapshots [source]
(_experimental_; expire 7 days; cannot* run GPU). 24 h max; use FS snapshots beyond. [source]
Daytona - OCI/Docker (also Kata/Sysbox); fastest provisioning, 27-90 ms (vendor). SDKs: [source]
Python, TS, Ruby, Go, Java + CLI + REST; open-source, BYOC. daytona.create(), [source]
sandbox.process.exec(...), sandbox.fs, sandbox.code_interpreter (stateful Python), [source]
sandbox.computer_use (desktop automation - Win/Linux/macOS). Declarative images built in code [source]
(Image.debian_slim("3.12").pip_install(...)), cached 24 h. _experimental_fork() = [source]
copy-on-write clone; _experimental_createSnapshot(); archive() moves FS to cheap object [source]
storage. Pricing: vCPU $0.0504/h, RAM $0.0162/GiB/h, H100 $3.95/h; $200 free credit. [source]
Cloudflare - two distinct products. (a) Sandbox SDK: a Docker-image container backed by a [source]
Durable Object - getSandbox(env.Sandbox, "id"), sandbox.exec('python …'), writeFile/readFile; [source]
wire containers, durable_objects, migrations in wrangler.jsonc. (b) **Dynamic Workers / [source]
Worker Loader API (open beta, Mar 2026) - isolates, not containers**: start in a few ms, a few [source]
MB RAM, ~100x faster than a container. Code Mode (@cloudflare/codemode) has the LLM write one [source]
function that calls codemode.toolName(args) instead of many tool round-trips (saves up to 80% [source]
tokens); DynamicWorkerExecutor runs it with globalOutbound: null to block all network. TS only. [source]

Tier 2 — concrete specifics, narrower fit

Vercel Sandbox (GA 2025; OSS SDK/CLI) - Firecracker microVM on infra ("Hive") powering 2.7M [source]
deploys/day. Sandbox.create({ runtime, source:{url,type:'git'}, resources:{vcpus}, ports, timeout }), [source]
runCommand({cmd,args}). Amazon Linux 2023; node22/24/26, python3.13. Timeout default 5 min, max [source]
45 min (Hobby) / 5 h (Pro+); persistent by default (auto-snapshots FS on stop, restores on resume). [source]
Fly Machines - Firecracker microVM via Machines API (POST /v1/apps/{app}/machines); cold ~300 ms, [source]
resume-from-suspended < 100 ms. Fly Volumes (local NVMe) with snapshot+fork. A low-level [source]
infra primitive (you orchestrate auto-start/stop), not an agent-shaped SDK - most teams wrap it. [source]
Runloop - "Devboxes" (VM-isolated workstations); Python/TS SDK + CLI. Stateful (snapshot/suspend/ [source]
resume) or stateless; Blueprints = shared custom images; Network Policies for egress; an [source]
Agent Gateway + MCP Hub proxy LLM/MCP creds so the devbox never sees real secrets. [source]
CodeSandbox SDK (now a Together company) - Firecracker VM per sandbox. sdk.sandboxes.create(...) [source]
/ .resume(id); memory snapshot/restore anytime; fork from HIBERNATED = 1-3 s, "Live Fork" from [source]
RUNNING capped at 5 (shared memory, degraded). Git-backed /project/workspace. [source]
Together Code Interpreter (TCI) (May 2025) - session-based Python execution; 60-min reusable [source]
sessions at $0.03/session; streams stdout/stderr; !pip install. Also available as an **MCP [source]
server via Smithery. Heavily pitched for RL training loops. Together Code Sandbox** = the [source]
configurable VM tier (any language, 2-64 vCPU, snapshots, Docker/Compose dev containers). [source]
Riza - API-first, <10 ms to first execution, no cold start / no boot. POST code via REST or [source]
Python/TS/Go SDK; configure stdin, files, network access, env vars per run; returns exit/stdout/ [source]
stderr. Self-hostable. Best for fast tool-running and evals, not long-lived dev environments. [source]
Northflank - microVM-backed sandboxes (Kata or gVisor), boot < 1 s; managed cloud **or BYOC [source]
(your VPC, 600 regions)**. Each workload its own kernel; scale-to-zero pauses compute billing while [source]
keeping storage. GPU H100 $2.74/h, CPU $0.01667/vCPU-h. Strong when compliance demands your-cloud. [source]

Tier 3 — built-in (lab-hosted) interpreters: zero infra, vendor's data plane

OpenAI Code Interpreter (Responses API) - `tools:[{type:"code_interpreter", container:{type:"auto" [source]
1g/4g/16g/64g (fixed for the container's life); auto or explicit (/v1/containers). Containers [source]
expire after 20 min idle; generated files come back as container_file_citation. [source]
Anthropic code execution tool - sandboxed container running Python + Bash + file ops. [source]
code_execution_20250825 (Bash + multi-lang, all models); code_execution_20260120 adds REPL [source]
state persistence + programmatic tool calling from inside the sandbox (Opus 4.5+/Sonnet 4.5+). [source]
50 free hours/day, then $0.05/hr/container. Integrates with the Files API and Agent Skills [source]
(container.skills, up to 8). Programmatic Tool Calling lets Claude orchestrate your tools in code [source]
so results bypass its context window. [source]
Cohere - no hosted interpreter. Cohere's Command models do tool use, and the docs show a [source]
**Python interpreter as a client-side tool** (you wire a PythonREPL/your own sandbox into the [source]
tool-use loop). So with Cohere you bring your own sandbox from Tiers 1-2. [source]
Positioning: built-ins are turnkey but the data plane runs on the vendor's infra - no BYOC, [source]
opaque/limited egress control, short idle expiry, per-vendor billing. The standalone vendors give you [source]
isolation choice, egress policy, persistence/forking, GPU, and **data-plane control / billing [source]
attribution**. Adapters exist to swap a hosted code_execution tool for your own sandbox compute. [source]

SDK patterns

The shape is near-identical across vendors: **create -> exec/run -> move files -> snapshot -> fork -> [source]
dispose**. Representative real calls: [source]
Create + run a command, then run code (E2B): [source]
Create with resources/GPU + exec with streamed output (Modal): [source]
Upload / download files: [source]
Snapshot (checkpoint) and restore: [source]
Fork (copy-on-write branch) - for parallel exploration / rollback: [source]
> E2B has no fork; emulate it by create_snapshot() then spawning N sandboxes from the snapshot_id. [source]
Persist on idle instead of killing (cost control): [source]
Block network entirely (egress chokepoint): [source]

Selection / decision guidance

Latency is contested - report ranges, not single numbers. Vendor/marketing figures (E2B ~150 ms, [source]
Daytona 27-90 ms, Modal sub-second) disagree with an independent benchmark [source]
(sandbox-comparison.pages.dev: E2B 0.515 s, Daytona 0.753 s, Modal 1.512 s cold start). Numbers [source]
swing 3-10x with region, warm pools, image size, and what you count as "start". Benchmark your path. [source]

Security model from the consumer side

The sandbox is one layer, not the whole defense. It contains untrusted code and meters egress, [source]
but it does not neutralize prompt injection or the lethal trifecta on its own. If the agent [source]
inside the sandbox still holds your private data and can reach the internet and ingests untrusted [source]
content, an injection can exfiltrate. Combine isolation with the architectural mitigations below. [source]
Egress is the highest-leverage control. Default-deny outbound, then allow-list. Use Modal [source]
block_network=True / outbound_cidr_allowlist, Cloudflare globalOutbound: null (host only via [source]
RPC), Daytona networkBlockAll/networkAllowList, Runloop Network Policies, Riza per-run network [source]
config. No egress + no private secrets in the sandbox = no exfiltration channel. [source]
Don't hand the sandbox real credentials. Prefer a credential broker/gateway (Runloop Agent [source]
Gateway / MCP Hub pattern) so the sandbox calls a proxy that holds the secret; the model never sees it. [source]
Architectural mitigations (cite, don't reinvent): the Dual-LLM pattern (Willison, 2023) - a [source]
Privileged LLM that holds tools but never sees untrusted content, and a Quarantined LLM that parses [source]
untrusted data with no tools; and CaMeL (Google DeepMind + ETH, Mar 2025, "Defeating Prompt [source]
Injections by Design") - the P-LLM emits a restricted-Python program, data carries capability [source]
metadata, and a custom interpreter enforces information-flow/access-control policies (~67% of AgentDojo [source]
attacks neutralized; caveat: relies on user-defined policies -> approval fatigue). [source]
Isolation strength is a knob. Firecracker/Kata microVM > gVisor > hardened OCI container. Match it [source]
to your threat model; the trade-off table and mechanics are in devops-linux-internals -> Linux Sandboxing. [source]
Treat outputs as untrusted too. Files/strings produced by sandboxed code can themselves carry [source]
injection; never feed a Quarantined-LLM/sandbox output straight back into a tool-wielding LLM. [source]

Anti-patterns & failure modes

Running model code in your app/build process "because it's faster." This is the whole reason [source]
sandboxes exist - one bad subprocess and you've shipped RCE. [source]
A sandbox with open egress + real secrets. That's the trifecta with extra steps; isolation without [source]
egress control is theater for data-exfiltration threats. [source]
Leaking sandboxes / paying for idle. Forgetting kill()/terminate() burns money and concurrency [source]
quota. Use auto-pause/idle-timeout and short timeouts for ephemeral tasks; kill when truly done. [source]
Trusting marketing cold-start numbers for a latency-critical UX without benchmarking your region/ [source]
image. Also: cold start != resume - a paused/standby resume can be 10x faster than a fresh boot. [source]
Over-forking shared-memory clones. CodeSandbox "Live Forks" (max 5, shared memory) degrade fast; [source]
fork from a hibernated parent or from a snapshot for clean independent branches. [source]
Assuming memory snapshots are universal. Modal memory snapshots can't run GPU and expire in 7 days; [source]
not every "snapshot" captures RAM (many are filesystem-only). Read which your provider means. [source]
Confusing two execution environments. With a hosted code_execution tool and your own [source]
client-side REPL, the model can mix them up (Anthropic's documented multi-computer caveat). Be explicit [source]
about which tool runs where. [source]
Picking the lab built-in when you need control. Built-ins run on the vendor's data plane - no BYOC, [source]
opaque egress, 20-min idle expiry. If you need persistence, GPU, or compliance, use a standalone vendor. [source]

2025-2026 frontier

"Code Mode" / programmatic tool calling is the year's biggest shift: instead of many tool-call [source]
round-trips, the LLM writes code that orchestrates tools inside the sandbox (Cloudflare Code Mode, [source]
Sep 2025; Anthropic Programmatic Tool Calling, Nov 2025). Cuts tokens up to ~80% and keeps tool [source]
outputs out of the context window - making the sandbox a first-class part of the agent's reasoning. [source]
Isolates as a container alternative (Cloudflare Dynamic Workers, GA-beta Mar 2026): ms starts, [source]
MB-scale memory, ~100x cheaper than containers for short LLM-code bursts - at the cost of JS-only and [source]
a thinner runtime than a full microVM. [source]
Persistence is becoming the default. Vercel auto-snapshots on stop; E2B/Daytona/Modal/CodeSandbox [source]
all offer pause-resume or fork. The mental model is shifting from "ephemeral exec" to "checkpointable, [source]
forkable agent workspaces." [source]
Built-in interpreters maturing fast. Anthropic's code_execution_20260120 adds REPL state + [source]
in-sandbox tool calling; OpenAI exposes 64 GB memory tiers - closing the gap with standalone vendors [source]
for non-BYOC use cases. [source]
Consolidation & BYOC. CodeSandbox folded into Together; Northflank/Daytona/Runloop push [source]
bring-your-own-cloud for regulated buyers. Independent benchmarks are now a real part of vendor [source]
selection - and they frequently contradict vendor latency claims, so measure your own path. [source]
Prompt-injection defense is still unsolved. CaMeL (~67% on AgentDojo) is the most promising [source]
design-level mitigation, but no provider's sandbox alone defeats the lethal trifecta; egress control [source]
+ dual-LLM/capability architecture remains mandatory. [source]

Sources

Simon Willison - The lethal trifecta for AI agents (Jun 16 2025): https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ [source]
E2B - Sandbox persistence / snapshots / Python SDK / pricing / MCP: https://e2b.dev/docs (sandbox/persistence, sandbox/snapshots, sdk-reference, billing, mcp) [source]
Modal - Sandboxes guide + modal.Sandbox reference: https://modal.com/docs/guide/sandboxes , https://modal.com/docs/reference/modal.Sandbox [source]
Daytona - Sandboxes / snapshots / declarative builder / pricing: https://www.daytona.io/docs/en/sandboxes/ , https://www.daytona.io/pricing [source]
Cloudflare - Code Mode (Sep 2025) & Dynamic Workers (Mar 2026) + Sandbox SDK: https://blog.cloudflare.com/code-mode/ , https://blog.cloudflare.com/dynamic-workers/ , https://developers.cloudflare.com/sandbox/get-started/ [source]
Vercel - Sandbox docs + GA blog + repo: https://vercel.com/docs/vercel-sandbox , https://github.com/vercel/sandbox [source]
Fly Machines (Firecracker, suspend/resume): https://qu3ry.net/articles/memory-resident-execution/fly-machines [source]
Runloop - Devbox overview + agent gateway: https://docs.runloop.ai/docs/devboxes/overview [source]
CodeSandbox SDK - overview + create/fork: https://codesandbox.io/docs/sdk , https://codesandbox.io/docs/sdk/create [source]
Together - Code Sandbox & Code Interpreter launch + TCI docs: https://www.together.ai/blog/code-sandbox-code-interpreter , https://docs.together.ai/docs/together-code-interpreter [source]
Riza (<10 ms, per-run egress): https://riza.io/ [source]
Northflank - Sandboxes product + docs: https://northflank.com/product/sandboxes [source]
OpenAI - Code Interpreter tool (containers, memory tiers): https://developers.openai.com/api/docs/guides/tools-code-interpreter [source]
Anthropic - Code execution tool + Advanced tool use (programmatic tool calling): https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool , https://www.anthropic.com/engineering/advanced-tool-use [source]
Simon Willison - CaMeL (Apr 11 2025) + Google research repo: https://simonwillison.net/2025/Apr/11/camel/ , https://github.com/google-research/camel-prompt-injection [source]
Independent sandbox benchmarks (cold-start, contested): https://sandbox-comparison.pages.dev/ , https://agentmarketcap.ai/blog/2026/04/10/sandboxed-code-execution-ai-agents-e2b-modal-daytona [source]
Cohere - tool use / client-side Python interpreter: https://docs.cohere.com/v2/page/basic-multi-step [source]
> Boundary note: kernel/OS isolation primitives (gVisor/Kata/Firecracker internals, seccomp, namespaces) defer to devops-linux-internals (references/linux-sandboxing-confinement.md); the general guardrails/prompt-injection topic (Dual-LLM, CaMeL) to ai-agents-orchestration (references/agent-reliability-and-guardrails.md); agent loop design to ai-agents-orchestration. Cold-start latency is contested - vendor claims vs independent benchmarks diverge 3-10x; benchmark your own path. [source]

Children

MicroVM vs gVisor vs container isolation (frontier)
Sandbox lifecycle (create/exec/dispose) (frontier)
Pause-resume & memory snapshots (frontier)
Filesystem snapshots & declarative images (frontier)
Sandbox forking (copy-on-write branching) (frontier)
Network egress policy (default-deny, allow-lists) (frontier)
The lethal trifecta & prompt-injection exfiltration (frontier)
Dual-LLM & CaMeL capability-based mitigation (frontier)
Code Mode / programmatic tool calling (frontier)
MCP-in-a-sandbox (gateways, credential brokering) (frontier)
GPU sandboxes for ML agents (frontier)
Built-in vs standalone vs BYOC sandboxes (frontier)

Frontier under this node: Built-in vs standalone vs BYOC sandboxes, Code Mode / programmatic tool calling, Dual-LLM & CaMeL capability-based mitigation, Filesystem snapshots & declarative images, GPU sandboxes for ML agents, MCP-in-a-sandbox (gateways, credential brokering), MicroVM vs gVisor vs container isolation, Network egress policy (default-deny, allow-lists), Pause-resume & memory snapshots, Sandbox forking (copy-on-write branching), Sandbox lifecycle (create/exec/dispose), The lethal trifecta & prompt-injection exfiltration

← the whole tree · 3D view· how to read this page