report.object
AI sandboxes for agent execution
Expert-reviewed from public records, platform data, primary sources, and private research beyond AI search. Use /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/sample before purchase, then download PDF, JSON, or Markdown after checkout.
page.markdown
AI sandboxes for agent execution.md
# AI sandboxes for agent execution
AI sandboxes are becoming the boundary where agents move from chat to action. Buyers should choose the approved execution route for code, browser, tools, state, credentials, recovery and evidence across model providers, hyperscalers, hosted sandbox platforms, browser routes and self-hosted runtimes.
## Object
| field | value |
| ---------------- | ------------------------------ |
| report_id | RPT_01KSK1V7Z9AISANDBOXROUTE01 |
| schema_version | 2026-05-28 |
| last_updated_at | 2026-06-01 |
| category | INFRA |
| sector | Technology |
| region | GLOBAL |
| confidence_score | 0.86 |
| source_count | 59 |
| evidence_count | 59 |
## Endpoints
| action | endpoint |
| ------------ | --------------------------------------------------------- |
| summary | /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01 |
| sample | /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/sample |
| schema | /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/schema |
| quote | /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/quote |
| purchase | /checkout/RPT_01KSK1V7Z9AISANDBOXROUTE01?view=agent |
| versions | /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/versions |
| changelog | /api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/changelog |
| monitor | /api/v1/monitors?report_id=RPT_01KSK1V7Z9AISANDBOXROUTE01 |
| mcp_resource | colophon://reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/sample |
## Coverage
| field | value |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| category | INFRA |
| sector | Technology |
| region | GLOBAL |
| topics | AI sandboxes, agent infrastructure, secure code execution, browser agents, stateful sandboxes, embedded agents, MCP security, microVMs, agent economics |
| source_classes | official_agent_docs, official_model_docs, pricing_page, platform_docs, sandbox_platform_docs, browser_platform_docs, isolation_technology, security_standard, research_paper, company_blog, open_source_repo, regulatory_timeline, security_conference |
| update_cadence | Weekly |
## Sample JSON
```json
{
"report_id": "RPT_01KSK1V7Z9AISANDBOXROUTE01",
"slug": "ai-sandboxes-agent-execution",
"schema_version": "2026-05-28",
"title": "AI sandboxes for agent execution",
"abstract": "AI sandboxes are becoming the boundary where agents move from chat to action. Buyers should choose the approved execution route for code, browser, tools, state, credentials, recovery and evidence across model providers, hyperscalers, hosted sandbox platforms, browser routes and self-hosted runtimes.",
"category": "INFRA",
"sector": "Technology",
"region": "GLOBAL",
"topics": [
"AI sandboxes",
"agent infrastructure",
"secure code execution",
"browser agents",
"stateful sandboxes",
"embedded agents",
"MCP security",
"microVMs",
"agent economics"
],
"last_updated_at": "2026-06-01T00:00:00Z",
"source_count": 59,
"evidence_count": 59,
"confidence_score": 0.86,
"web_url": "/r/ai-sandboxes-agent-execution/RPT_01KSK1V7Z9AISANDBOXROUTE01",
"sample_endpoint": "/api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/sample",
"inventory_endpoint": "/api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/inventory",
"full_endpoint": "/api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/full",
"schema_endpoint": "/api/v1/reports/RPT_01KSK1V7Z9AISANDBOXROUTE01/schema",
"redaction": {
"status": "sample",
"paid_sections_redacted": true,
"preview_limits": [
"summary",
"table_of_contents",
"evidence_profile"
]
},
"coverage": {
"category": "INFRA",
"sector": "Technology",
"region": "GLOBAL",
"topics": [
"AI sandboxes",
"agent infrastructure",
"secure code execution",
"browser agents",
"stateful sandboxes",
"embedded agents",
"MCP security",
"microVMs",
"agent economics"
],
"source_classes": [
"official_agent_docs",
"official_model_docs",
"pricing_page",
"platform_docs",
"sandbox_platform_docs",
"browser_platform_docs",
"isolation_technology",
"security_standard",
"research_paper",
"company_blog",
"open_source_repo",
"regulatory_timeline",
"security_conference"
]
},
"confidence": {
"overall_confidence": 0.86,
"source_quality": 0.89,
"source_recency": 0.91,
"source_density": 0.87,
"claim_verifiability": 0.85,
"geographic_coverage": 0.82,
"known_gaps": [
"No independent public benchmark compares the same agent task across provider-native code tools, hosted Linux sandboxes, browser platforms and self-hosted execution routes.",
"Published prices use incompatible metres and rarely include retries, idle time, review minutes, recordings, egress, storage, cleanup or failed actions.",
"Provider documentation does not consistently publish independent sandbox-escape testing, customer data-retention artefacts or tenant-isolation evidence.",
"Azure, AWS and Alibaba expose important first-party cloud sandbox routes, but public documentation still does not make their same-workload economics, log export and network-deny behaviour directly comparable to independent sandbox providers.",
"Stateful microVM products publish stronger snapshot and resume primitives, but buyers still need private tests for process, memory, descriptor and network-state continuity.",
"Embedded sandbox runtimes are early; public evidence does not yet show production incident patterns, peripheral-safety benchmarks or long-horizon device update results.",
"Browser-agent platforms expose useful session and recording features, but target-site terms, CAPTCHA handling and identity policy remain workload-specific.",
"MCP security standards and research are moving quickly; route approvals should be refreshed when authorization, token-passthrough or SSRF guidance changes.",
"Recent sandbox research is valuable for probe design but is not a substitute for private evals on the buyer's repositories, tools, data and browser sessions."
]
},
"document": {
"object": "report_document",
"schemaVersion": "2026-05-28",
"title": "AI sandboxes for agent execution",
"subtitle": "The sandbox is the agent control plane.",
"abstract": "AI sandboxes are becoming the boundary where agents move from chat to action. Buyers should choose the approved execution route for code, browser, tools, state, credentials, recovery and evidence across model providers, hyperscalers, hosted sandbox platforms, browser routes and self-hosted runtimes.",
"category": "INFRA",
"sector": "Technology",
"region": "GLOBAL",
"topics": [
"AI sandboxes",
"agent infrastructure",
"secure code execution",
"browser agents",
"stateful sandboxes",
"embedded agents",
"MCP security",
"microVMs",
"agent economics"
],
"sources": [
{
"id": "S1",
"label": "OpenAI Agents SDK - Sandbox Agents quickstart",
"sourceClass": "official_agent_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://openai.github.io/openai-agents-js/guides/sandbox-agents/"
},
{
"id": "S2",
"label": "OpenAI Agents SDK - Sandbox Agents concepts",
"sourceClass": "official_agent_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://openai.github.io/openai-agents-js/guides/sandbox-agents/concepts/"
},
{
"id": "S3",
"label": "OpenAI API - Code Interpreter containers",
"sourceClass": "official_model_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://developers.openai.com/api/docs/guides/tools-code-interpreter"
},
{
"id": "S4",
"label": "OpenAI API pricing - containers",
"sourceClass": "pricing_page",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://openai.com/api/pricing/"
},
{
"id": "S5",
"label": "Anthropic Claude API - code execution tool",
"sourceClass": "official_model_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool"
},
{
"id": "S6",
"label": "Anthropic Claude API - Managed Agents self-hosted sandboxes",
"sourceClass": "official_agent_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes"
},
{
"id": "S7",
"label": "Cloudflare Sandbox SDK - Claude Managed Agents setup",
"sourceClass": "platform_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://developers.cloudflare.com/sandbox/tutorials/claude-managed-agents/"
},
{
"id": "S8",
"label": "Cloudflare Sandbox SDK overview",
"sourceClass": "sandbox_platform_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://developers.cloudflare.com/sandbox/"
},
{
"id": "S9",
"label": "Cloudflare Sandbox SDK pricing",
"sourceClass": "pricing_page",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://developers.cloudflare.com/sandbox/platform/pricing/"
},
{
"id": "S10",
"label": "Google Gemini API - code execution",
"sourceClass": "official_model_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://ai.google.dev/gemini-api/docs/code-execution"
},
{
"id": "S11",
"label": "Vercel Sandbox concepts",
"sourceClass": "sandbox_platform_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://vercel.com/docs/vercel-sandbox/concepts"
},
{
"id": "S12",
"label": "Vercel Sandbox pricing and limits",
"sourceClass": "pricing_page",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "sample",
"transformChain": [],
"url": "https://vercel.com/docs/vercel-sandbox/pricing"
},
{
"id": "S19",
"label": "Browserbase browsers",
"sourceClass": "browser_platform_docs",
"accessedAt": "2026-06-01",
"status": "verified",
"access": "locked",
"transformChain": [],
"url": "https://www.browserbase.com/browsers"
}
],
"evidence": [
{
"id": "E1",
"sourceId": "S1",
"claimIds": [
"C1",
"C3"
],
"summary": "OpenAI's Sandbox Agents quickstart describes a persistent workspace where agents can search files, edit, run commands, generate artefacts and resume from saved sandbox state.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E2",
"sourceId": "S2",
"claimIds": [
"C1",
"C3"
],
"summary": "OpenAI's Sandbox Agents concepts split the outer runtime, which owns approvals, tracing, handoffs and resume bookkeeping, from the sandbox session, which owns commands, file changes and environment isolation.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E3",
"sourceId": "S3",
"claimIds": [
"C2"
],
"summary": "OpenAI Code Interpreter requires a container object described as a fully sandboxed virtual machine; containers can be created automatically or explicitly, use memory tiers, and expire after inactivity.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E5",
"sourceId": "S5",
"claimIds": [
"C2"
],
"summary": "Anthropic's code execution tool lets Claude run Python and bash in a sandboxed container, but the page states the feature is not eligible for Zero Data Retention and warns about confusion when multiple execution environments are exposed.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E6",
"sourceId": "S6",
"claimIds": [
"C3"
],
"summary": "Anthropic self-hosted sandboxes keep Managed Agents orchestration on Anthropic's side while moving tool execution, filesystem and network egress into infrastructure controlled by the buyer.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E10",
"sourceId": "S10",
"claimIds": [
"C2"
],
"summary": "Google's Gemini API code execution tool generates and runs Python, has a 30-second maximum runtime for the code environment, cannot install arbitrary libraries, and is billed through model input and output tokens.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E11",
"sourceId": "S11",
"claimIds": [],
"summary": "Vercel Sandbox documents short-lived isolated Linux environments backed by Firecracker microVMs, with clean starts or snapshots, network access, full root access and automatic termination.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
},
{
"id": "E19",
"sourceId": "S19",
"claimIds": [],
"summary": "Browserbase documents persistent browser sessions with cookies, file upload and download, Chrome extensions, proxy routing and custom network controls.",
"status": "verified",
"confidence": 0.86,
"access": "sample"
}
],
"claims": [
{
"id": "C1",
"statement": "The sandbox is now the agent control plane: it decides which data, files, commands, tools, network paths, state and evidence can participate in an accepted run.",
"confidence": 0.9,
"evidenceIds": [
"E1",
"E2",
"E6",
"E11"
],
"access": "sample"
},
{
"id": "C2",
"statement": "Provider-native code execution is the fastest way to add computation, but it is usually a narrow route with language, retention, runtime, library and state limits.",
"confidence": 0.88,
"evidenceIds": [
"E3",
"E5",
"E10"
],
"access": "sample"
},
{
"id": "C3",
"statement": "Agent harnesses and sandbox backends are separating; buyers can increasingly keep one orchestration pattern while changing where execution runs.",
"confidence": 0.89,
"evidenceIds": [
"E1",
"E2",
"E6"
],
"access": "sample"
},
{
"id": "C4",
"statement": "Sandbox selection should start from the workload route, not the vendor category.",
"confidence": 0.86,
"evidenceIds": [
"E3",
"E5",
"E10",
"E11",
"E19"
],
"access": "sample"
}
],
"colophon": {
"checkedAt": "2026-06-01",
"latestRevisionAt": "2026-06-01T00:00:00Z",
"reviewStandard": "expert_human_reviewed",
"kinetics": {
"speed": "fast",
"impact": 0.86,
"momentum": 0.9,
"businessImpact": "Sandbox choice changes whether agentic products can touch code, browsers, files, credentials and internal services without creating unmanaged operational or security risk.",
"rateOfChange": "Execution tools are moving into provider, cloud, browser, self-hosted and MCP-governed routes inside a quarterly approval cycle, so cost, retention and security evidence can stale before renewal.",
"from": "Model tools added as isolated features",
"toward": "Route-governed execution control planes for agents"
},
"watch": [
"2 August 2026: EU AI Act general application phase starts; EU-facing agent-sandbox routes may need risk-classification, logging and regulatory-sandbox evidence instead of isolation-only approval.",
"5 August 2026: Black Hat USA 2026 Briefings open; sandbox-escape or agent-toolchain papers could raise microVM, browser and MCP negative-test requirements.",
"6 August 2026: Robotic Hacking Village at DEF CON 34 opens; robot exploitation or AI model attack sessions could move embedded-device sandboxing from prototype route to driver-permission and fail-safe test case.",
"6 August 2026: Adversary Village at DEF CON 34 opens; adversary-simulation or supply-chain talks could add tool-poisoning and dependency-execution probes to the MCP route gate.",
"7 August 2026: Cloud Village at DEF CON 34 opens; cloud-service attack labs could tighten hosted-sandbox egress, credential injection and tenant-isolation recommendations."
],
"gapAnalysis": "Comparable accepted-execution cost telemetry, workload-level failure rates, independent sandbox-escape tests, retention audit artefacts, cloud-log export parity and same-workload code, browser, MCP and repository benchmarks remain unavailable in public sources."
},
"body": {
"sections": [
{
"id": "verdict",
"title": "Executive summary",
"access": "sample",
"dek": "The sandbox decision is an approval decision, not an infrastructure afterthought.",
"claimIds": [
"C1",
"C2",
"C3",
"C4"
],
"evidenceIds": [
"E1",
"E2",
"E3",
"E5",
"E6",
"E11",
"E19"
],
"blocks": [
{
"id": "verdict-narrative",
"evidenceIds": [
"E1",
"E2",
"E3",
"E5",
"E6",
"E11",
"E19"
],
"type": "section_narrative",
"lead": "Approve sandbox routes before scaling agents.",
"body": [
"A vendor sandbox is useful only when the route from work to accepted output controls the source set, filesystem, network egress, credentials, browser identity, tools, state, reviewers and evidence record.",
"Provider-native code tools are the fastest place to start for bounded Python or data-analysis tasks. Azure and AWS now deserve first-class comparison because their sandbox routes inherit cloud identity, networking, logging, session lifecycle and procurement controls. Hosted Linux sandboxes, devboxes, stateful microVM orchestrators and browser platforms become necessary when the agent must install dependencies, inspect repositories, run servers, keep process state, use a real browser or touch internal services. Embedded sandboxes become a separate approval route when the agent-authored code can touch device hardware.",
"The platform owner should approve a route for each workload class, not a universal sandbox provider for every agent."
],
"detail": [
"Immediate decision: approve built-in model code tools only for low-state analysis and artefact production; include Azure and AWS where enterprise cloud controls are load-bearing; buy managed sandboxes for repository, browser and multi-step agent work; self-host or boundary-control execution when private repositories, internal services or secrets enter the route."
]
},
{
"id": "sandbox-decision-tree",
"title": "Board-level sandbox decision",
"evidenceIds": [
"E1",
"E2",
"E3",
"E5",
"E6",
"E11",
"E19"
],
"type": "decision_tree",
"lead": "Choose the boundary by the action the agent can take.",
"steps": [
{
"prompt": "Does the task only need bounded Python over uploaded files?",
"tone": "info",
"branches": [
{
"label": "Yes",
"outcome": "Use provider-native code execution with retention and output-download controls.",
"tone": "success"
},
{
"label": "No",
"outcome": "Move to a workspace, browser or internal-tool route.",
"next": "workspace",
"tone": "monitor"
}
]
},
{
"prompt": "Does the agent need repositories, package installs, servers or long-running filesystem state?",
"note": "workspace",
"tone": "info",
"branches": [
{
"label": "Yes",
"outcome": "Use hosted Linux sandboxes or devboxes with snapshots, logs and resource caps.",
"tone": "success"
},
{
"label": "No",
"outcome": "Keep the route narrow and do not buy a devbox just to run a cell.",
"tone": "neutral"
}
]
},
{
"prompt": "Does the agent need logged-in browser identity or internal services?",
"tone": "warning",
"branches": [
{
"label": "Browser identity",
"outcome": "Use a browser route with cookie, proxy, session, recording and data-retention policy.",
"tone": "warning"
},
{
"label": "Internal services",
"outcome": "Use self-hosted or boundary-controlled execution with token audience and egress brokering.",
"tone": "blocked"
}
]
}
]
},
{
"id": "approved-route-summary",
"title": "Sandbox decision by workload",
"evidenceIds": [
"E3",
"E5",
"E6",
"E10",
"E11",
"E19"
],
"type": "table",
"columns": [
{
"key": "workload",
"label": "Workload",
"align": "left"
},
{
"key": "starting_route",
"label": "Starting route",
"align": "left"
},
{
"key": "approval_question",
"label": "Approval question",
"align": "left"
},
{
"key": "blocker",
"label": "Blocker",
"align": "left"
}
],
"rows": [
{
"workload": "Data cell, chart, one-off computation",
"starting_route": "Provider-native code execution",
"approval_question": "Can files, retention, runtime and library limits support the accepted output?",
"blocker": "Sensitive data or persistent state without approved retention."
},
{
"workload": "Coding agent over a repository",
"starting_route": "Hosted devbox or Linux sandbox",
"approval_question": "Can the route run tests, capture diffs, export logs and recover state?",
"blocker": "Repository secrets, production deploy keys or unbounded package execution."
},
{
"workload": "Long-lived agent loop with running process state",
"starting_route": "Stateful microVM sandbox",
"approval_question": "Can memory, filesystem, network and process state be suspended, snapshotted and restored with evidence?",
"blocker": "Opaque snapshots that cannot prove what state was preserved or discarded."
},
{
"workload": "Browser task in logged-in applications",
"starting_route": "Browser sandbox",
"approval_question": "Can cookies, proxy, session recording, downloads and identity be governed?",
"blocker": "Shared user identity without action evidence."
},
{
"workload": "Internal MCP or enterprise tool use",
"starting_route": "Self-hosted or egress-brokered execution",
"approval_question": "Are tokens audience-bound and are tool capabilities constrained?",
"blocker": "Token passthrough or MCP servers running with broad host privileges."
},
{
"workload": "Hardware device or microcontroller app",
"starting_route": "Embedded runtime sandbox",
"approval_question": "Which drivers, peripherals, network calls and physical outputs are approved?",
"blocker": "Agent-authored code can actuate hardware without a driver permission boundary."
}
]
},
{
"id": "route-definition-callout",
"title": "Route definition",
"evidenceIds": [
"E1",
"E2",
"E3",
"E5",
"E6",
"E11",
"E19"
],
"type": "callout",
"tone": "neutral",
"body": "Route means the approved path from work to accepted output: the source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger that make an AI result usable."
},
{
"id": "verdict-section-callout",
"title": "Approve the route, not the container",
"evidenceIds": [
"E1",
"E2",
"E3",
"E5",
"E6",
"E11",
"E19"
],
"type": "callout",
"tone": "warning",
"body": "A sandbox provider can supply isolation, runtime and lifecycle controls. It does not by itself approve which data, credentials, browser sessions, MCP tools, network paths, reviewers or recovery rules may be used for a production result."
}
]
},
{
"id": "what-changed",
"title": "What changed",
"access": "sample",
"dek": "Agent execution is splitting into harness, workspace and boundary choices.",
"claimIds": [
"C2",
"C3"
],
"evidenceIds": [
"E3",
"E5",
"E10",
"E1",
"E2",
"E6"
],
"blocks": [
{
"id": "what-changed-narrative",
"evidenceIds": [
"E3",
"E5",
"E10",
"E1",
"E2",
"E6"
],
"type": "section_narrative",
"lead": "The market moved from code cells to routeable agent workspaces.",
"body": [
"OpenAI's Agents SDK now treats sandboxed workspaces as a first-class agent harness [E1, E2], while Code Interpreter remains a narrower provider-native computation tool [E3, E4]. Anthropic's code execution tool gives Claude a sandboxed container [E5], while self-hosted Managed Agents move the execution boundary into buyer-controlled infrastructure [E6, E7]. Microsoft Foundry and Amazon Bedrock AgentCore add a hyperscaler lane where the code route is evaluated with cloud identity, logging, network and session controls [E49, E52].",
"That split matters because an enterprise can adopt an agent loop while changing the sandbox backend as data, cost, security and workload constraints change. Azure Container Apps dynamic sessions govern session pools, lifecycle and networking [E50, E51], Bedrock AgentCore resources separate resources from sessions [E52, E53], and stateful microVM products such as Bhatti and Tensorlake make lifecycle, capacity and state more consequential than files alone [E37, E39].",
"The practical consequence is procurement leverage: the buyer can ask each vendor which layer it owns, which layer can be replaced, and which evidence survives if the sandbox is swapped."
]
},
{
"id": "harness-boundary-table",
"title": "Harness and boundary are separating",
"evidenceIds": [
"E3",
"E5",
"E10",
"E1",
"E2",
"E6"
],
"type": "table",
"columns": [
{
"key": "layer",
"label": "Layer",
"align": "left"
},
{
"key": "examples",
"label": "Examples",
"align": "left"
},
{
"key": "buyer_read",
"label": "Buyer read",
"align": "left"
},
{
"key": "proof",
"label": "Proof to demand",
"align": "left"
}
],
"rows": [
{
"layer": "Model-native code tool",
"examples": "OpenAI Code Interpreter; Anthropic code execution; Gemini code execution; Microsoft Foundry Code Interpreter; Bedrock AgentCore Code Interpreter",
"buyer_read": "Fastest bounded route for computation and artefacts.",
"proof": "Retention terms, language/runtime limits, file handling, expiry, billing, cloud logging and network mode."
},
{
"layer": "Agent harness",
"examples": "OpenAI Sandbox Agents; Anthropic Managed Agents",
"buyer_read": "The loop, prompt state and events can be distinct from where tools execute.",
"proof": "State export, tool event stream, pause/resume semantics and backend portability."
},
{
"layer": "Sandbox backend",
"examples": "Vercel, E2B, Daytona, Modal, Cloudflare, Runloop, Azure Container Apps dynamic sessions, Tensorlake, Bhatti",
"buyer_read": "Provides the computer, filesystem, network and lifecycle.",
"proof": "Isolation primitive, image control, secrets, logs, snapshots, suspend/resume, timeout and cost metre."
},
{
"layer": "Browser backend",
"examples": "Browserbase and Stagehand; Scrapybara; AgentBay; Cloudflare Browser Run in the Claude integration",
"buyer_read": "Carries identity and web-side effects, so it needs a separate policy.",
"proof": "Cookie storage, proxy path, recordings, downloads, identity, retention and terms."
}
]
}
]
},
{
"id": "route-inventory",
"title": "Route inventory",
"access": "locked",
"dek": "The workload determines the boundary and the evidence record.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "route-inventory-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "provider-lanes",
"title": "Provider lanes",
"access": "locked",
"dek": "The useful shortlist is by lane, not by logo.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "provider-lanes-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "economics",
"title": "Economics",
"access": "locked",
"dek": "Sandbox pricing is only useful after normalisation.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "economics-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "security-boundary",
"title": "Security boundary",
"access": "locked",
"dek": "Isolation primitive and route policy must both be explicit.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "security-boundary-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "browser-route",
"title": "Browser route",
"access": "locked",
"dek": "The browser carries user authority.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "browser-route-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "state-recovery-observability",
"title": "State and recovery",
"access": "locked",
"dek": "Agent state is part of production infrastructure.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "state-recovery-observability-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "benchmarks-and-research",
"title": "Benchmarks and research",
"access": "locked",
"dek": "Research shapes probes; private evals approve routes.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "benchmarks-and-research-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "build-buy-self-host",
"title": "Build, buy or self-host",
"access": "locked",
"dek": "Ownership should follow the boundary, not engineering pride.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "build-buy-self-host-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "route-risk-scenarios",
"title": "Reapproval triggers",
"access": "locked",
"dek": "Approvals should age with product and security changes.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "route-risk-scenarios-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "known-unknowns",
"title": "Known unknowns",
"access": "locked",
"dek": "What a buyer still needs to test privately.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "known-unknowns-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "vendor-directory",
"title": "Vendor and standard directory",
"access": "locked",
"dek": "Representative products, platforms and tools to include in a sandbox route shortlist.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "vendor-directory-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "recommended-next-steps",
"title": "Recommended next steps",
"access": "locked",
"dek": "A 30-day route approval plan for platform, security and product owners.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "recommended-next-steps-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "source-ledger",
"title": "Source ledger",
"access": "locked",
"dek": "Primary sources and diligence anchors behind the analysis.",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "source-ledger-locked",
"title": "Locked section",
"evidenceIds": [],
"type": "callout",
"tone": "locked",
"body": "Purchase or subscribe to unlock this section."
}
]
},
{
"id": "glossary",
"title": "Glossary",
"access": "sample",
"claimIds": [],
"evidenceIds": [],
"blocks": [
{
"id": "glossary-table",
"title": "Terms used in this report",
"caption": "Definitions are reader aids, not separate evidence claims.",
"evidenceIds": [],
"type": "table",
"columns": [
{
"key": "term",
"label": "Term",
"align": "left"
},
{
"key": "meaning",
"label": "Plain meaning",
"align": "left"
}
],
"rows": [
{
"term": "Route",
"meaning": "The approved path from work to accepted output: source set, data boundary, model or vendor channel, tools, reviewer, evidence record and reapproval trigger."
},
{
"term": "API",
"meaning": "Application programming interface: a governed software connection used by an app or workflow to call a model or service."
},
{
"term": "SDK",
"meaning": "Software development kit: packaged code and tools developers use to connect a product to an API or service."
},
{
"term": "Token",
"meaning": "A chunk of text used for billing, context windows and rate limits. It is usually smaller than a word, not a page count."
},
{
"term": "SLO",
"meaning": "Service-level objective: a service target that may be published or internal, and may not be contractual."
}
]
}
]
}
]
}
},
"gap_analysis": "Comparable accepted-execution cost telemetry, workload-level failure rates, independent sandbox-escape tests, retention audit artefacts, cloud-log export parity and same-workload code, browser, MCP and repository benchmarks remain unavailable in public sources.",
"kinetics": {
"speed": "fast",
"impact": 0.86,
"momentum": 0.9,
"businessImpact": "Sandbox choice changes whether agentic products can touch code, browsers, files, credentials and internal services without creating unmanaged operational or security risk.",
"rateOfChange": "Execution tools are moving into provider, cloud, browser, self-hosted and MCP-governed routes inside a quarterly approval cycle, so cost, retention and security evidence can stale before renewal.",
"from": "Model tools added as isolated features",
"toward": "Route-governed execution control planes for agents"
},
"watch_signals": [
"2 August 2026: EU AI Act general application phase starts; EU-facing agent-sandbox routes may need risk-classification, logging and regulatory-sandbox evidence instead of isolation-only approval.",
"5 August 2026: Black Hat USA 2026 Briefings open; sandbox-escape or agent-toolchain papers could raise microVM, browser and MCP negative-test requirements.",
"6 August 2026: Robotic Hacking Village at DEF CON 34 opens; robot exploitation or AI model attack sessions could move embedded-device sandboxing from prototype route to driver-permission and fail-safe test case.",
"6 August 2026: Adversary Village at DEF CON 34 opens; adversary-simulation or supply-chain talks could add tool-poisoning and dependency-execution probes to the MCP route gate.",
"7 August 2026: Cloud Village at DEF CON 34 opens; cloud-service attack labs could tighten hosted-sandbox egress, credential injection and tenant-isolation recommendations."
],
"sample_findings": [
"AI sandboxes are becoming the control plane for agent execution because they bind data, filesystem, tools, network, state, reviewers and evidence."
]
}
```