STEP 01 · Handoff
The agent writes code
A model produces code it now needs to run to make progress. Running it on your own machine hands generated code your permissions, your files, your network. That is the risk a sandbox removes.
Visual explainer
How a sandbox runs your code
An AI agent writes code that has to run somewhere. Follow that code on its round trip, from a prompt to an isolated machine and back, one scroll at a time.
Scroll to begin
01/ 07
STEP 02 · Handoff
It calls the sandbox
Instead of running locally, the agent ships the code to a sandbox in a single request. No servers to provision, no machine to keep warm, just an API call.
STEP 03 · Execution
A fresh microVM boots
The host spins up a brand-new micro virtual machine just for this run. Modern ones start in around 150ms, fast enough that the agent barely waits. Each run gets its own clean machine.
STEP 04 · Execution
Your code runs behind a real wall
The code executes inside the microVM, behind its own kernel boundary. If it deletes files, opens sockets, or loops forever, it only touches the sandbox, never the host or your data.
STEP 05 · Return
The result streams back
Standard output, any files it wrote, and the return value flow back to the agent, which reads them and decides its next move.
STEP 06 · Return
State can be paused, not lost
Need to continue on the next turn? Snapshot the filesystem or pause the memory, then resume the exact same environment later instead of rebuilding it.
STEP 07 · Return
Then it is gone
When the run ends the microVM is torn down. Billing is per second of real compute, so an idle or finished agent costs nothing while nothing is running.
The short version
Why agents need a sandbox at all
An AI coding agent is only useful because it can run things: install a package, execute a script, run the tests. The moment it does that on your machine, generated code inherits your access. A sandbox is the boundary that lets an agent run untrusted code freely while the blast radius stays inside a disposable box.
microVM, container, or isolate: the trade you are actually making
Every sandbox picks a point on one axis: how strong is the wall around your code, versus how fast it comes up. A V8 isolate shares a process and starts in about 50ms, a thin boundary that suits trusted, short JavaScript. A container shares the host kernel and starts in about 90ms. A microVM gives each run its own kernel through hardware virtualization, a real wall, at the cost of a 150 to 400ms boot. For running code you did not write, that kernel boundary is the point.
What it costs, and the parts that hide
Sandboxes bill per second of active compute, usually quoted per vCPU-hour. The headline rate is the easy part. What moves the real bill is the cold start you pay on every run, whether idle or paused time is metered, and per-creation fees that some providers charge separately from compute. If your agent spins up thousands of short-lived sandboxes, those two line items matter more than the rate.
How the numbers actually differ Full benchmark →
| Sandbox | Start | Isolation | $/vCPU-hr | GPU |
|---|---|---|---|---|
| Cloudflare Sandbox SDK | 50ms | V8 isolate + container | $0.072 | No |
| Daytona | 90ms | Docker container | $0.05 | Yes |
| E2B | 150ms | Firecracker microVM | $0.05 | No |
| Fly.io Machines | 300ms | microVM | $0.07 | Yes |
| Vercel Sandbox | 400ms | Firecracker microVM | $0.128 | No |
| Modal | 800ms | gVisor | $0.14 | Yes |
Live from our vendor data, verified and dated on each vendor page. Start times mix cold boots, warm resumes and isolate starts, see the benchmark for the method.
Frequently asked
What is an AI agent sandbox?
It is an isolated, throwaway environment where an AI agent can run code it generated without touching your machine, your files, or your network. The agent sends the code, the sandbox runs it behind a security boundary, and only the result comes back.
How fast do sandboxes start?
It depends on the isolation model. V8 isolates start in about 50ms (Cloudflare), Docker containers in about 90ms (Daytona), and microVMs in roughly 150 to 400ms (E2B about 150ms, Vercel Sandbox about 400ms). gVisor-based sandboxes like Modal start in under a second.
Is a microVM more secure than a container?
For running untrusted code, generally yes. A microVM gives each run its own kernel, so a compromise stays inside the guest. A container shares the host kernel, a lighter boundary that is faster to start but thinner. That is the core trade-off between speed and isolation strength.
How are sandboxes priced?
Almost always per second of active compute, usually quoted per vCPU-hour. E2B and Daytona are about $0.05/vCPU-hour, Cloudflare about $0.072, Modal about $0.14 (it includes GPUs). Watch two hidden costs: whether idle or paused time is billed, and per-creation fees on some providers.
Do sandboxes support GPUs?
Most are CPU-only. If your agent needs a GPU in the same environment as its code, the shortlist is Modal (T4 up to B200), Beam (H100 about $1.74/hour), and Daytona (H100 about $3.95/hour). Everyone else makes you reach a separate GPU service over the network.
Can a sandbox keep state between agent turns?
Yes. Many let you snapshot the filesystem or pause the running memory, then resume the exact same environment on the next turn instead of rebuilding it. E2B sessions can run up to 24 hours; Fly Machines and others keep persistent volumes at zero idle cost when stopped.
The Sandbox Brief
What moved in the sandbox world, every Friday.
Pricing changes, new entrants, benchmark refreshes and one sharp take from Eve Harper. Read by engineers choosing where their agents and apps run. No fluff. Read the archive.