Sandboxing

Language-based monitoring cannot fully reveal an agent’s internal computation, the paper argues. Secure agent runtimes still need isolation and data-flow controls independent of self-reporting.

California’s financial regulator built an offline AI pipeline around replayable data, hardware-backed redaction, model routing, and one-way updates for court-defensible evidence.

Run SDK executes agent-generated JavaScript or TypeScript behind narrow host functions, with resumable approval and auth boundaries instead of application-level eval access.

Tool-by-tool restrictions failed to contain a chip-design agent. Enforce permissions at the substrate, isolate files by role, and propagate approved spec changes from one source of truth.

Production agents need bounded write authority, infrastructure-stamped identity, and human-only overrides; a broad token and tool list cannot control blast radius.

Docker argues that agent safety belongs in a model-agnostic runtime: contain each task, grant narrowly scoped capabilities, and judge new access requests outside the agent's trust boundary.

Agent instructions are not security boundaries. Put identity, scoped capabilities, policy gates, audit receipts, and revocation outside the model before granting production access.

Enterprise agent requirements should shape the foundation, not be bolted onto a working POC. Design audit, sensitive-data access, human escalation, and evals into the architecture.

Reelful maps the coding-agent pattern onto real-footage editing: analyze media, approve a plan, edit as Remotion code in a sandbox, then verify before rendering.

Vercel’s AI SDK harness now runs Cline behind the same interface as six other coding-agent runtimes, while keeping Cline in the host and sandboxing only its tools.

Deno treats production agents as untrusted and filters their outbound traffic outside the agent, showing how broad operational access can coexist with protocol-aware controls.

Cursor Cloud Agents can start from continuously prepared environment snapshots instead of reinstalling each session. Internal time to first token improved 3x, with failed builds falling back to the last good state.

Vercel’s AI SDK factory shows a practical scaling pattern: narrow agents produce evidence inside sandboxes while humans retain merge authority and review effort follows risk.

Codex exposes several reusable harness patterns: deferred tools, persistent browser execution, sandboxed edits, automated permission review, WebSockets, and server-side compaction.

Superconductor’s team workflow keeps agent sessions visible across interfaces, runs them in isolated cloud environments, and benchmarks models on its own codebase before routing work.

Hermes can route inference through Vercel’s model gateway and move command execution into an opt-in cloud microVM, separating model access from the machine where the agent runs.

Herdr can place each terminal coding agent in a separate Vercel Sandbox, then return its work as an opt-in Git patch instead of letting remote edits touch the local checkout.

Kenton Varda argues that personal AI-generated apps need per-user code and strong isolation, not one server-owned version. The demo shows agents modifying app code inside a constrained local runtime.

Factory runs API routes, middleware, and webhooks in one Next.js backend at one billion daily requests and 350ms p95. Its agents also deploy internal tools through Vercel APIs under review guardrails.

Post-training gains depend heavily on task selection, rollout quality, and environment design. For many enterprise agents, curated SFT may deliver most of the value before costly RL.

Repo-only tasks omit deployments, incidents, traffic, and distributed failures. Training infrastructure agents may require multi-node environments with real resources, despite much higher setup cost.

Vercel Sandbox can now isolate agents as Linux users while exposing selected files through a shared group directory. This gives multi-agent harnesses a simpler permission boundary.

Vercel tokens can now be restricted to one project, giving agent jobs and automation read/write access without exposing unrelated project, team, or user resources.

Gemini Managed Agents now add model selection, sandbox hooks, token caps, schedules, and free-tier access, covering several controls needed for unattended coding work.

Sandstone pairs composable agent workflows with preview deployments and private data connectivity, showing the infrastructure a small team used to operate enterprise legal automation.

Harbor frames agent development as an empirical loop: run agents in reproducible sandboxes, verify outcomes, inspect trajectories, and evaluate every harness or model change.

Long-running coding agents need isolated, persistent sandboxes: microVMs limit kernel exposure, while incremental snapshots enable recovery, branching, and faster placement across a fleet.

OpenClaw’s trusted-proxy mode removes duplicate WebSocket tokens and device pairing, but only if proxy IPs and identity headers are tightly constrained.

Tencent Cloud open-sourced a KVM microVM sandbox for agent code execution: sub-60ms cold starts, under 5MB overhead per instance, and E2B SDK compatibility as a self-hostable drop-in.

Anthropic reruns Terminal-Bench 2.0 under six resource configs and finds a 6-point score swing from container limits alone — treat sub-3-point leaderboard gaps as noise until the eval setup is documented.

Grok2API fronts Grok Build, Web, and Console account pools with OpenAI- and Anthropic-compatible APIs, but its unofficial SSO routing creates terms, credential, and renewal risk.

Maka gives local coding-agent runs a durable event log, sandbox boundary, recovery path, and shared runtime across desktop, CLI, and evals. It is early, source-only software with changing interfaces.

Vercel Sandbox can now mount FUSE filesystems — S3 buckets, network shares, any FUSE driver — as POSIX paths, so sandboxed agent code can stream remote data without copying it in first.

ODS packages local inference, agents, RAG, workflows, image generation, and operations into one installable stack, reducing homelab integration work at the cost of a large dependency surface.

Anthropic details Managed Agents, a hosted long-horizon agent service that separates the harness from its sandboxes — stateless brains, replaceable containers, and a 60% drop in p50 time-to-first-token.