What is an AI agent sandbox?

Why agents need a sandbox

Language models are now good at writing code, and the most capable agents work by acting: they write a script, run it, read the error, and try again. That loop needs somewhere to execute. Running model-generated code directly on your laptop or production servers is risky for three reasons:

• Mistakes: an agent can delete files, fill a disk or run an infinite loop.
• Attacks: through prompt injection, content the agent reads can instruct it to run malicious commands or exfiltrate secrets.
• Multi-tenancy: if you serve many users, one user’s agent must never see another’s files.

A sandbox contains all three. It is disposable, so the cost of a bad action is throwing the sandbox away.

What a modern agent sandbox includes

• A Linux environment with a filesystem, shell and package managers (pip, npm, apt).
• An SDK or API to create, run commands in, upload/download files to, and destroy sandboxes.
• Fast startup — usually from a pre-built image or snapshot.
• Resource limits (CPU, memory, disk, time) and network controls.
• Often: a Jupyter-style code interpreter, preview URLs for web servers the agent starts, a virtual desktop for computer use, and pause/resume for long-lived work.

How sandboxes are isolated

The isolation layer is the most important technical difference between providers. From weakest to strongest boundary, the common options are:

• Plain containers — namespaces, cgroups and seccomp on a shared kernel. Fast and cheap, but a kernel bug can become an escape. See container isolation.
• User-space kernels — gVisor intercepts system calls so the workload rarely touches the host kernel directly.
• MicroVMs — Firecracker, Cloud Hypervisor or Kata Containers give each sandbox its own kernel behind hardware virtualization.

Language-level sandboxes (V8 isolates, WebAssembly) are another option for small snippets but cannot run arbitrary Linux tools. Our isolation guide compares these in depth.

Common use cases

• Coding agents that clone a repository, run tests and open pull requests — see best sandboxes for coding agents.
• Code interpreters for data analysis, charts and file conversion — see best for code interpreters.
• Computer-use and browser agents that need a desktop — see best for computer use.
• Reinforcement learning and evaluations that need thousands of identical, resettable environments — see best for RL and evals.
• Running untrusted tools and MCP servers behind a boundary.

How to choose one

Start from the workload: how long sessions last, whether state must persist, whether you need GPUs, and where your data is allowed to live. Then compare isolation, startup time in your region, pricing at your expected concurrency, and SDK fit. Our buyer’s checklist walks through it, and the comparison table lays out every provider side by side.

Frequently asked questions