Agent sandboxes are the runtime fence between “helpful coding agent” and “untrusted code with your API keys.” Cloud products wrap Firecracker microVMs, Firecracker-adjacent stacks, or container APIs; self-hosters stitch open-source SPACE or QEMU/KVM. None remove the need for scoped credentials and prompt injection defenses — they shrink blast radius.
Agents that act on your behalf need rules. See how explainx helps secure your agents →
TL;DR matrix
| Provider / stack | Isolation model | Typical use | Docs / primary source |
|---|---|---|---|
| E2B | Cloud microVMs via API | Prod agents, ephemeral dev envs | E2B docs |
| Modal | Container/gVisor-style sandboxes on their cloud | GPU + agent workloads | Modal sandboxes |
| Daytona | Dev workspaces, agent-oriented | Longer sessions, team dev boxes | Daytona docs |
| Cloudflare Sandbox SDK | Durable Objects + containers at edge | Edge agents, low-latency tools | Cloudflare 1.0 post |
| SPACE (Perplexity) | Open-source Firecracker-based | Self-host, study prod design | SPACE open source |
| Capsem / local VM | QEMU VM on your machine | Air-gapped agent testing | Capsem guide |
Threat model first
Ask what you are defending:
- Developer laptop — agent runs on your machine with your SSH keys (worst case: full takeover).
- CI runner — secrets in env vars; supply-chain via
curl | bash. - Multi-tenant SaaS — customer A must never read customer B disks.
- Computer-use agents — browser + OS events expand attack surface (Cursor computer use).
Sandboxes address 2–3 well. They do not fix poisoned training data or social engineering. Pair isolation with AgentBeam when agents can trigger payments, deletes, or production deploys.
E2B: API-first microVMs
E2B sells ephemeral Linux sandboxes tuned for agents: start VM, run commands, snapshot, destroy. Integrations target coding agents that need a clean room per task.
Pros: fast integration, isolation stronger than raw Docker on a shared host, good for “run untrusted repo scripts” demos.
Cons: SaaS trust boundary; egress policies you must configure; cost at always-on concurrency.
Fit: startups shipping agent features without hiring a virtualization team.
Modal: sandboxes plus GPU fabric
Modal combines serverless containers with optional GPUs — attractive when agents compile CUDA code or run eval harnesses. Sandboxes are one primitive inside a broader compute product.
Pros: one vendor for batch jobs and agent shells; strong Python SDK ergonomics.
Cons: opinionated cloud; understand their isolation docs before multi-tenant prod.
Fit: ML teams already on Modal for training who want the same control plane for agents.
Daytona: long-lived dev environments
Daytona emphasizes persistent developer workspaces with agent hooks — closer to “cloud IDE” than per-request microVM. Useful when sessions last hours and developers want state.
Pros: human-friendly UX, Git and SSH idioms.
Cons: persistence increases forensic difficulty after compromise; patch retention policies.
Fit: internal coding agents paired with engineers, not anonymous public agents.
Cloudflare Sandbox SDK
Cloudflare Sandbox SDK 1.0 binds containers to Durable Objects for edge-adjacent agents. Latency to users globally can beat single-region microVMs.
Pros: integrates with Workers networking; good for constrained tool runners.
Cons: not a full Linux desktop; understand container boundary vs microVM marketing language.
Fit: lightweight tool executors, not full graphical computer-use.
SPACE and self-hosted Firecracker paths
Perplexity open-sourced SPACE (see our coverage) to document the Firecracker path behind Perplexity Computer. Teams with SRE depth can replicate microVM orchestration on their own metal.
Pros: inspect code, air-gap, customize networking.
Cons: you own kernel patches, CVE response, and capacity planning.
Fit: regulated industries or researchers studying agent isolation.
Local VM wrappers (Capsem pattern)
Capsem and similar projects wrap Claude Code, Codex, or Gemini CLI in a local QEMU VM with proxy controls — middle ground between “bare laptop” and cloud microVM.
Pros: no recurring sandbox bill; works offline.
Cons: manual setup; still your responsibility when escapes land (Vercel KVM).
Pricing claims need verification
Startups publish dramatic cost comparisons — e.g. Agent37 versus Vercel. Treat list-price tables as hypotheses until you load-test your agent’s CPU minutes, idle keep-alive, and egress. Baseten’s free sandbox window is another promo-tier data point — note limits and expiry.
Google Cloud, Baseten, and Prime-style environments
Not every team buys a pure “agent sandbox” SKU. Google Cloud agent sandboxes document five isolation properties worth using as a scorecard: identity, network, storage, time bounds, and observability — regardless of vendor logo.
Baseten Sandboxes target standby-time SLAs for agent evals. Read promo limits before baking them into prod architecture.
Prime Sandboxes emphasize filesystem checkpoints for RL rollouts — a different axis (reproducible forks) than ephemeral E2B shells. Pick checkpointing when training agents, ephemeral VMs when serving untrusted end users.
NVIDIA Vera CPU early-testing claims tie sandbox vendors to CPU efficiency narratives; treat benchmark quotes as vendor-sourced until you rerun them.
When containers are consciously “enough”
Some internal agents run in locked-down CI: no outbound internet, read-only source mount, secrets from OIDC-federated short tokens. That is acceptable when threat actors are only your developers and prompts are not user-controlled.
The moment customers can steer prompts — support bots, public codegen demos, marketplace plugins — container-only isolation on multi-tenant hosts needs microVM depth. VS Code Remote-SSH is not a sandbox remains the canonical warning against confusing remote access with isolation.
Prompt injection risk when agents run outside a hardened sandbox
Cold start vs warm pool economics
MicroVMs boot quickly relative to full VMs, but agent products still fight cold start. Pools of warm sandboxes cost money while idle. Model that in unit economics: if average task is 90 seconds but you pay for 15-minute minimums, cheap per-minute list prices mislead.
Daytona-style persistence reduces boot frequency but increases disk snapshot size — backups and GDPR deletes get harder. E2B-style ephemeral VMs simplify compliance per task at the cost of re-installing dependencies unless you bake custom templates.
Decision tree
-
Untrusted end-user prompts? → microVM SaaS or self-hosted SPACE; no bare Docker socket on shared hosts.
-
Need GPUs inside the sandbox? → Modal or cloud-specific GPU sandboxes; verify driver passthrough security docs.
Computer-use agents extend sandbox scope beyond shell commands to GUI automation -
Need graphical computer use? → dedicated desktop isolation products; do not reuse CLI sandbox APIs blindly (Perplexity Computer checks).
-
Air-gapped eval? → Capsem-style local VM or offline Prime-style checkpoints.
-
Edge latency globally? → Cloudflare Workers path with strict tool allowlists.
Hardening checklist (any vendor)
- Network egress: default deny; allowlist package registries and git hosts.
- Secrets: inject short-lived tokens; never bake prod keys into images.
- Filesystem: read-only root where possible; tmpfs for untrusted writes.
- Lifetime: destroy sandboxes after task completion; cap max runtime.
- Logging: ship stdout/stderr to tamper-evident storage for incident review.
- Updates: subscribe to provider security mail — KVM and container CVEs move fast.
How this fits the harness map
Sandboxes sit below the agent harness (Claude Code, Codex, OpenCode). Harnesses decide tools; sandboxes decide where bash runs. Compare harnesses in our ranked list only after you pick an isolation story.
For browser agents, add a separate review of computer-use permissions (Vercel agent-desktop) — clicking the host OS is stricter than running pytest in a VM.
What security reviewers ask in 2026
- Escape history: any KVM or container CVE in the stack (Vercel disclosure).
- Tenant isolation tests: can sandbox A list processes of sandbox B?
- Credential forwarding: OAuth refresh tokens inside the VM — rotate on compromise.
- Supply chain: agent installs packages from PyPI without hash pinning.
- Forensics: can you reconstruct commands after an incident (n0n ransomware via exposed agent workspaces is the cautionary tale for exposed consoles, not identical to microVMs but same class of “agent plus network”).
Link sandbox choice to the November attacks timeline when writing internal security memos — leadership wants concrete blast-radius numbers.
Build vs buy rubric
| Factor | Buy SaaS sandbox | Self-host SPACE / KVM |
|---|---|---|
| Time to first demo | Hours | Weeks |
| Patch duty | Vendor | You |
| Compliance packets | Ask vendor SOC2 | Your infra team |
| Custom networking | Limited | Full control |
Most startups buy, then self-host when sandbox spend crosses engineer salary or when regulators demand on-prem. Neither choice removes application-layer controls.
Integrating with coding agent workflows
Wire sandboxes at the tool boundary, not inside the model weights. Claude Code, Codex, and OpenCode expect shell execution hooks — swap the hook implementation to call your sandbox API instead of child_process on the laptop. Keep git credentials outside the VM; mount a sparse read-only mirror when possible.
For MCP-heavy stacks, run the MCP server outside the sandbox but expose only sandbox-scoped tools (file read within workspace, test runner). Our Executor 2 MCP gateway guide shows how gateways policy-filter tools — combine gateway rules with sandbox networks for defense in depth.
Document agent runbooks for on-call: how to kill stuck sandboxes, rotate OAuth tokens, export disk images after a suspected compromise, and preserve logs for postmortems. Run tabletop exercises with a prompt injection playbook so engineers know whether to blame the model or the runtime. Re-run the drill after every major harness upgrade.
Provider features and open-source licenses are accurate as of November 8, 2026; confirm security whitepapers before compliance sign-off.