Skip to content
Back to catalogue

Verified intelligence · Expert-reviewed from public records, platform data, primary sources, and private research beyond AI search.

INFRATechnologyGLOBAL

AI sandboxes for agent execution

AI sandboxes are becoming the boundary where agents move from chat to action. Buyers should choose the approved execution route for code, browser, tools, state, credentials, recovery and evidence across model providers, hyperscalers, hosted sandbox platforms, browser routes and self-hosted runtimes.

The colophon

Landscape reviewed
2026-06-01
Latest revision
2026-06-01
Kinetics
Kinetics: activeImpact 0.86 · momentum 0.90 · vector 0.778 balls · 71 px/s

Sandbox choice changes whether agentic products can touch code, browsers, files, credentials and internal services without creating unmanaged operational or security risk. Execution tools are moving into provider, cloud, browser, self-hosted and MCP-governed routes inside a quarterly approval cycle, so cost, retention and security evidence can stale before renewal.

To watch
  • 2 August 2026: EU AI Act general application phase starts; EU-facing agent-sandbox routes may need risk-classification, logging and regulatory-sandbox evidence instead of isolation-only approval.
  • 5 August 2026: Black Hat USA 2026 Briefings open; sandbox-escape or agent-toolchain papers could raise microVM, browser and MCP negative-test requirements.
  • 6 August 2026: Robotic Hacking Village at DEF CON 34 opens; robot exploitation or AI model attack sessions could move embedded-device sandboxing from prototype route to driver-permission and fail-safe test case.
  • 6 August 2026: Adversary Village at DEF CON 34 opens; adversary-simulation or supply-chain talks could add tool-poisoning and dependency-execution probes to the MCP route gate.
  • 7 August 2026: Cloud Village at DEF CON 34 opens; cloud-service attack labs could tighten hosted-sandbox egress, credential injection and tenant-isolation recommendations.
Known unknowns
Comparable accepted-execution cost telemetry, workload-level failure rates, independent sandbox-escape tests, retention audit artefacts, cloud-log export parity and same-workload code, browser, MCP and repository benchmarks remain unavailable in public sources.

Contents

  1. Executive summary
  2. What changed
  3. Route inventory
  4. Provider lanes
  5. Economics
  6. Security boundary
  7. Browser route
  8. State and recovery
  9. Benchmarks and research
  10. Build, buy or self-host
  11. Reapproval triggers
  12. Known unknowns
  13. Vendor and standard directory
  14. Recommended next steps
  15. Source ledger
  16. Glossary

Executive summary

The sandbox decision is an approval decision, not an infrastructure afterthought. Approve sandbox routes before scaling agents. A vendor sandbox is useful only when the route from work to accepted output controls the source set, filesystem, network egress, credentials, browser identity, tools, state, reviewers and evidence record.

Provider-native code tools are the fastest place to start for bounded Python or data-analysis tasks. Azure and AWS now deserve first-class comparison because their sandbox routes inherit cloud identity, networking, logging, session lifecycle and procurement controls. Hosted Linux sandboxes, devboxes, stateful microVM orchestrators and browser platforms become necessary when the agent must install dependencies, inspect repositories, run servers, keep process state, use a real browser or touch internal services. Embedded sandboxes become a separate approval route when the agent-authored code can touch device hardware.

The platform owner should approve a route for each workload class, not a universal sandbox provider for every agent.

Immediate decision: approve built-in model code tools only for low-state analysis and artefact production; include Azure and AWS where enterprise cloud controls are load-bearing; buy managed sandboxes for repository, browser and multi-step agent work; self-host or boundary-control execution when private repositories, internal services or secrets enter the route.

Board-level sandbox decision

Choose the boundary by the action the agent can take.

  1. Does the task only need bounded Python over uploaded files?

    Yes

    Use provider-native code execution with retention and output-download controls.

    No

    Move to a workspace, browser or internal-tool route.

    Next: workspace

  2. Does the agent need repositories, package installs, servers or long-running filesystem state?

    workspace
    Yes

    Use hosted Linux sandboxes or devboxes with snapshots, logs and resource caps.

    No

    Keep the route narrow and do not buy a devbox just to run a cell.

  3. Does the agent need logged-in browser identity or internal services?

    Browser identity

    Use a browser route with cookie, proxy, session, recording and data-retention policy.

    Internal services

    Use self-hosted or boundary-controlled execution with token audience and egress brokering.

Sandbox decision by workload

WorkloadStarting routeApproval questionBlocker
Data cell, chart, one-off computationProvider-native code executionCan files, retention, runtime and library limits support the accepted output?Sensitive data or persistent state without approved retention.
Coding agent over a repositoryHosted devbox or Linux sandboxCan the route run tests, capture diffs, export logs and recover state?Repository secrets, production deploy keys or unbounded package execution.
Long-lived agent loop with running process stateStateful microVM sandboxCan memory, filesystem, network and process state be suspended, snapshotted and restored with evidence?Opaque snapshots that cannot prove what state was preserved or discarded.
Browser task in logged-in applicationsBrowser sandboxCan cookies, proxy, session recording, downloads and identity be governed?Shared user identity without action evidence.
Internal MCP or enterprise tool useSelf-hosted or egress-brokered executionAre tokens audience-bound and are tool capabilities constrained?Token passthrough or MCP servers running with broad host privileges.
Hardware device or microcontroller appEmbedded runtime sandboxWhich drivers, peripherals, network calls and physical outputs are approved?Agent-authored code can actuate hardware without a driver permission boundary.

What changed

Agent execution is splitting into harness, workspace and boundary choices. The market moved from code cells to routeable agent workspaces. OpenAI's Agents SDK now treats sandboxed workspaces as a first-class agent harness 12, while Code Interpreter remains a narrower provider-native computation tool 34. Anthropic's code execution tool gives Claude a sandboxed container 5, while self-hosted Managed Agents move the execution boundary into buyer-controlled infrastructure 67. Microsoft Foundry and Amazon Bedrock AgentCore add a hyperscaler lane where the code route is evaluated with cloud identity, logging, network and session controls 4952.

That split matters because an enterprise can adopt an agent loop while changing the sandbox backend as data, cost, security and workload constraints change. Azure Container Apps dynamic sessions govern session pools, lifecycle and networking 5051, Bedrock AgentCore resources separate resources from sessions 5253, and stateful microVM products such as Bhatti and Tensorlake make lifecycle, capacity and state more consequential than files alone 3739.

The practical consequence is procurement leverage: the buyer can ask each vendor which layer it owns, which layer can be replaced, and which evidence survives if the sandbox is swapped.

Harness and boundary are separating

LayerExamplesBuyer readProof to demand
Model-native code toolOpenAI Code Interpreter; Anthropic code execution; Gemini code execution; Microsoft Foundry Code Interpreter; Bedrock AgentCore Code InterpreterFastest bounded route for computation and artefacts.Retention terms, language/runtime limits, file handling, expiry, billing, cloud logging and network mode.
Agent harnessOpenAI Sandbox Agents; Anthropic Managed AgentsThe loop, prompt state and events can be distinct from where tools execute.State export, tool event stream, pause/resume semantics and backend portability.
Sandbox backendVercel, E2B, Daytona, Modal, Cloudflare, Runloop, Azure Container Apps dynamic sessions, Tensorlake, BhattiProvides the computer, filesystem, network and lifecycle.Isolation primitive, image control, secrets, logs, snapshots, suspend/resume, timeout and cost metre.
Browser backendBrowserbase and Stagehand; Scrapybara; AgentBay; Cloudflare Browser Run in the Claude integrationCarries identity and web-side effects, so it needs a separate policy.Cookie storage, proxy path, recordings, downloads, identity, retention and terms.

Glossary

Terms used in this report

TermPlain meaning
RouteThe approved path from work to accepted output: source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger.
APIApplication programming interface: a governed software connection used by an app or workflow to call a model or service.
SDKSoftware development kit: packaged code and tools developers use to connect a product to an API or service.
TokenA chunk of text used for billing, context windows and rate limits. It is usually smaller than a word, not a page count.
SLOService-level objective: a service target that may be published or internal, and may not be contractual.

Definitions are reader aids, not separate evidence claims.

MCP PREVIEW INVENTORY

What the locked report contains

AI sandboxes are becoming the boundary where agents move from chat to action. Buyers should choose the approved execution route for code, browser, tools, state, credentials, recovery and evidence across model providers, hyperscalers, hosted sandbox platforms, browser routes and self-hosted runtimes.

Schema endpoints

  • Sample object: /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/sample
  • Inventory object: /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/inventory
  • Schema contract: /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/schema

Coverage fields

  • Category: INFRA
  • Sector: Technology
  • Region: GLOBAL
  • Topics: AI sandboxes, agent infrastructure, secure code execution, browser agents, stateful sandboxes, embedded agents, MCP security, microVMs, agent economics

Schema contract

  • Contract: colophon.report_document v2026-05-28
  • Payload schemas: document, summary, sample, inventory, full_report
  • Required top-level fields: title, subtitle, abstract, category, sector, region, topics, sources, evidence, claims, colophon, body
  • Integrity rules: evidence.sourceId must reference sources[].id claim.evidenceIds[] must reference evidence[].id evidence.claimIds[] must reference claims[].id section and block evidence references must resolve colophon.kinetics.speed must match the momentum band for the business impact x momentum model

Data-point inventory

  • vendor_or_actor_ledger: entity names; product categories; source references; confidence notes
  • buyer_decision_fields: pricing signals; deployment constraints; risk flags; monitoring fields
  • evidence_index: source class; access date; claim linkage; verification status

Section inventory

  1. 1. Executive summaryPreview

    decision-ready conclusions; major findings; confidence caveats

  2. 2. What changedPreview

    structured findings; supporting evidence; buyer-use fields

  3. 3. Route inventoryLocked

    structured findings; supporting evidence; buyer-use fields

  4. 4. Provider lanesLocked

    structured findings; supporting evidence; buyer-use fields

  5. 5. EconomicsLocked

    structured findings; supporting evidence; buyer-use fields

  6. 6. Security boundaryLocked

    structured findings; supporting evidence; buyer-use fields

  7. 7. Browser routeLocked

    structured findings; supporting evidence; buyer-use fields

  8. 8. State and recoveryLocked

    structured findings; supporting evidence; buyer-use fields

  9. 9. Benchmarks and researchLocked

    structured findings; supporting evidence; buyer-use fields

  10. 10. Build, buy or self-hostLocked

    structured findings; supporting evidence; buyer-use fields

  11. 11. Reapproval triggersLocked

    structured findings; supporting evidence; buyer-use fields

  12. 12. Known unknownsLocked

    structured findings; supporting evidence; buyer-use fields

  13. 13. Vendor and standard directoryLocked

    normalized entity rows; source ledger; evidence-to-claim mapping

  14. 14. Recommended next stepsLocked

    structured findings; supporting evidence; buyer-use fields

  15. 15. Source ledgerLocked

    normalized entity rows; source ledger; evidence-to-claim mapping

  16. 16. GlossaryPreview

    structured findings; supporting evidence; buyer-use fields

Relevance signals

  • Confidence score: 0.86
  • Source classes: official_agent_docs, official_model_docs, pricing_page, platform_docs, sandbox_platform_docs, browser_platform_docs, isolation_technology, security_standard, research_paper, company_blog, open_source_repo, regulatory_timeline, security_conference
  • Known unknowns: Comparable accepted-execution cost telemetry, workload-level failure rates, independent sandbox-escape tests, retention audit artefacts, cloud-log export parity and same-workload code, browser, MCP and repository benchmarks remain unavailable in public sources.
  • Watch signals: 2 August 2026: EU AI Act general application phase starts; EU-facing agent-sandbox routes may need risk-classification, logging and regulatory-sandbox evidence instead of isolation-only approval. 5 August 2026: Black Hat USA 2026 Briefings open; sandbox-escape or agent-toolchain papers could raise microVM, browser and MCP negative-test requirements. 6 August 2026: Robotic Hacking Village at DEF CON 34 opens; robot exploitation or AI model attack sessions could move embedded-device sandboxing from prototype route to driver-permission and fail-safe test case. 6 August 2026: Adversary Village at DEF CON 34 opens; adversary-simulation or supply-chain talks could add tool-poisoning and dependency-execution probes to the MCP route gate. 7 August 2026: Cloud Village at DEF CON 34 opens; cloud-service attack labs could tighten hosted-sandbox egress, credential injection and tenant-isolation recommendations.

Locked continuation

Purchase or subscribe to unlock the full findings, evidence ledger, and buyer-ready recommendations.

HumanAgent