Cloudflare's Sandbox SDK hits a 1.0 preview, and Devin moves in
July 24, 2026 · by Eve Harper
Part of the archive: a retrospective issue compiled after the fact so the record is complete. It was not sent to subscribers.
The busiest AI-sandbox week of the stretch. Cloudflare did two things that, together, tell you where it wants to sit in the agent stack, and Modal shipped again.
If you read one item this week, make it the Cloudflare SDK 1.0 preview. The breaking changes signal a real point of view.
What moved
Cloudflare Sandbox SDK 1.0 preview
On July 23 Cloudflare published a Sandbox SDK 1.0 preview on the npm @next tag. It collapses execution to a single sandbox.exec() call, drops session-scoped execution, moves to RPC-only transport, improves PTY support, and makes the code interpreter an optional extension. Breaking changes are a good sign here: a team willing to remove its own API surface usually knows what the API should have been.
Devin runs on Cloudflare, one sandbox per session
Two days earlier, on July 21, Cloudflare documented Cognition's Devin running on Cloudflare, each Devin session in its own isolated sandbox backed by Cloudflare Containers. This is the pattern to watch: the agent product and the sandbox infrastructure decoupling, so a coding agent can rent isolation from whoever runs it cheapest and closest.
Modal 1.5.3
Also on July 23, Modal shipped 1.5.3: programmatic log-retrieval APIs, workspace and environment billing summaries, an RBAC roles interface replacing members, per-endpoint compute-region, and about 2.5x faster large writes in Sandbox filesystem methods. The billing-summary APIs are the quiet standout. Cost observability is becoming table stakes.
Worth a click
- Cloudflare Sandbox changelog ↗ The 1.0 preview breaking changes and the earlier transport deprecations.
- Modal changelog ↗ 1.5.3 in full.
Decoupling is the theme. Eve