Updated 2026-10-19 · Vendor facts checked on each vendor's own docs, Oct 18-19, 2026 · Directory figures from our Oct 19, 2026 crawl
AI agent sandboxes: what they are, how the main options differ, and how to run agents safely
An AI agent sandbox is an isolated computer where an agent can run code and shell commands without touching your machine, data or credentials. E2B, Vercel Sandbox, Docker Sandboxes and Cloudflare Containers use microVMs; Modal defaults to gVisor; Daytona defaults to containers. A sandbox limits damage, but OWASP still calls for least privilege and human approval.
What is an AI agent sandbox?
An AI agent sandbox is a separate, disposable computer, usually a microVM, a hardened container or a full VM, where an agent can run the code it writes, install packages and execute shell commands. If the code is wrong or hostile, the damage stays inside. Vercel describes its product as running 'untrusted or agent-generated code in isolated Linux microVMs', and Cloudflare says sandboxed code 'cannot directly read the memory or data of your application'. OWASP's AI Agent Security Cheat Sheet lists 'Allow agents to execute arbitrary code without sandboxing' as a don't. Its Top 10 for Agentic Applications, released Dec 9, 2025, names Unexpected Code Execution (ASI05) as one of the ten main agent risks.
Sources: vercel.com/docs/sandbox · developers.cloudflare.com/sandbox · cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html · genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai
How do E2B, Daytona, Modal, Vercel Sandbox, Cloudflare and Docker differ?
They differ in isolation, session length and where they run. E2B gives each sandbox a Linux VM (the Firecracker project lists E2B as a user), and pausing keeps both files and memory. Its maximum continuous runtime is 1 hour on Hobby and 24 hours on Pro. Daytona runs Linux containers by default and offers Linux VM, Windows, macOS and GPU classes. Modal runs on gVisor or a VM runtime, from 5 minutes by default up to 24 hours. Vercel Sandbox uses Firecracker microVMs, with sessions of up to 45 minutes on Hobby and 24 hours on Pro. Cloudflare offers microVM Containers or Dynamic Workers for JavaScript, Python and WebAssembly. Docker Sandboxes run coding agents in microVMs locally or in Docker's cloud.
Sources: docs.e2b.dev · e2b.dev/docs/billing · firecracker-microvm.github.io · daytona.io/docs/en/sandboxes · modal.com/docs/guide/sandboxes · vercel.com/docs/sandbox · vercel.com/docs/sandbox/pricing · developers.cloudflare.com/sandbox · docs.docker.com/ai/sandboxes
| Option | Isolation | Session limits (per vendor docs) | Runs where | Notable safety controls | Source |
|---|---|---|---|---|---|
| E2B | Linux VM per sandbox; listed as a Firecracker user | Max continuous runtime: 1 hour (Hobby), 24 hours (Pro) | Managed cloud | Pause saves filesystem and memory | docs.e2b.dev; firecracker-microvm.github.io |
| Daytona | Linux containers by default, each with a dedicated kernel, filesystem and network stack per Daytona; Linux VM, Windows, macOS (via use.computer) and GPU classes | Auto-stop after 15 minutes of inactivity by default (configurable, or 0 to disable); wall-clock TTL optional | Managed cloud (US, EU regions) | Ephemeral sandboxes; pause/fork only on VM classes | daytona.io/docs/en/sandboxes |
| Modal | gVisor (Google's container runtime) or a VM runtime with its own Linux kernel; GPU sandboxes gVisor only | Default 5 minutes, configurable up to 24 hours | Managed cloud | Runtime choice per sandbox (gVisor or VM) | modal.com/docs/guide/sandboxes |
| Vercel Sandbox | Firecracker microVM with its own filesystem and network | Default timeout 5 minutes; max session 45 minutes (Hobby), 24 hours (Pro/Enterprise) | Managed cloud | Isolated filesystem and network per microVM | vercel.com/docs/sandbox; /pricing |
| Cloudflare | Containers: a microVM with its own kernel and network. Dynamic Workers: isolated runtime for JS, Python, Wasm | See Cloudflare's Sandbox lifetime docs | Cloudflare's network, through a Worker; Workers Paid plan | Worker decides which APIs and whether Internet is reachable (enableInternet: false, globalOutbound: null) | developers.cloudflare.com/sandbox |
| Docker Sandboxes | microVM isolation for coding agents | Not stated on overview | Your machine or Docker's cloud | Host-side proxy injects credentials; agent sees a sentinel | docs.docker.com/ai/sandboxes (+ /architecture) |
| Firecracker (DIY) | KVM microVM; 5 emulated devices; jailer | You decide | Your own Linux hosts | Jailer adds a second isolation barrier | firecracker-microvm.github.io |
| Perplexity SPACE (self-host) | Firecracker microVM per task | Idle sandboxes suspend after 6 hours (per MarkTechPost) | Linux x86_64 host with KVM | Per-sandbox egress gateway; secrets never enter the guest | MarkTechPost, Oct 16, 2026 (third-party summary) |
| Claude Code built-in sandbox | OS-level (Seatbelt on macOS, bubblewrap on Linux/WSL2) | n/a (local) | Your machine | Off by default; shell commands only; network proxy with domain allowlist | code.claude.com/docs/en/sandboxing |
No prices in the table on purpose: each vendor bills differently (Vercel: Active CPU; E2B: per-second compute), so a fair price comparison needs a worked example per workload. Vercel's own published example is in its docs.
What is a Firecracker microVM, and why do agent sandboxes use it?
Firecracker is an open-source virtual machine monitor, licensed under Apache 2.0, that AWS built to run Lambda. It uses Linux KVM to start lightweight VMs that, per the project, boot in under 125 ms with under 5 MiB of memory overhead and expose only 5 emulated devices. A companion 'jailer' adds a second layer of Linux isolation in case the VM barrier is broken. That mix of VM-level isolation and container-like speed is why sandbox providers use it: Vercel Sandbox runs on Firecracker, and the Firecracker site lists E2B, Fly.io and Kata Containers among its users. In mid-October 2026 (reported Oct 16), Perplexity open-sourced SPACE, the Firecracker sandbox behind Perplexity Computer, under Apache 2.0.
Sources: firecracker-microvm.github.io · vercel.com/docs/sandbox · marktechpost.com/2026/10/16/perplexity-open-sources-space-firecracker-microvm-sandbox-ai-agents
How do you run an AI agent safely?
Start from OWASP's guidance, then add a sandbox. OWASP's Excessive Agency entry (LLM06:2025) names three root causes: excessive functionality, excessive permissions and excessive autonomy. The fixes follow from those: give the agent only the tools it needs, avoid open-ended tools such as 'run a shell command' where a narrower tool will do, use read-only scopes, require human approval for high-impact actions, and enforce authorization in the downstream system rather than trusting the model. The OWASP cheat sheet adds logging of every tool call, plus token, cost and retry limits. Inside the sandbox, block outbound network by default and keep credentials outside it. Docker's sandbox proxy and Claude Code's mask mode both show the agent a placeholder instead of the real key. The approval gates our own bot crew runs under are written up in our playbook.
Sources: genai.owasp.org/llmrisk/llm062025-excessive-agency · cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html · docs.docker.com/ai/sandboxes/architecture · code.claude.com/docs/en/sandboxing
Is a sandbox enough to keep an agent safe?
No. A sandbox contains code execution, but it doesn't stop an agent from misusing the tools and data you hand it. Claude Code's docs are explicit: its built-in sandbox, which is off by default, covers shell commands only, while file tools, MCP servers and hooks run outside it. Anthropic also warns that 'effective sandboxing requires both filesystem and network isolation'. Network rules are the weak spot. In Perplexity's own red-team report on SPACE ('Escaping SPACE: Part I', Sep 23, 2026), 0 of 108 runs escaped the VM to the host, yet agents bypassed the egress policy in 11 of 54 partial-network runs before fixes. Perplexity found a network-policy bypass on 8 of 10 third-party platforms it tested. OWASP's agentic list also covers identity and privilege abuse (ASI03).
Sources: code.claude.com/docs/en/sandboxing · perplexity.ai/hub/blog/escaping-space-part-i · genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai
When do you need an AI agent sandbox?
You need one whenever an agent runs code or commands you haven't reviewed. That covers coding agents that install packages and run tests, data agents that execute generated Python, browsing or computer-use agents that open untrusted pages, and any product that runs one customer's agent next to another's. Vercel lists running AI agent output, user uploads or third-party scripts 'without exposing your production systems' as the core use, and Cloudflare adds build pipelines and development previews. You may not need one if the agent only calls a few narrow, read-only APIs. OWASP prefers granular tools over open-ended ones, so removing the shell tool can beat sandboxing it. If you can't remove code execution, sandbox it.
Sources: vercel.com/docs/sandbox · developers.cloudflare.com/sandbox · genai.owasp.org/llmrisk/llm062025-excessive-agency
Which sandbox and code-execution tools are in the DartzDabz directory?
Our directory has 7 sandbox or code-execution tools among 2,191 agent tools, as of Oct 19, 2026. The list covers cloud computers and Linux VMs for agents (Celesto Cloud Computers, BoxCompute, Everpod), a hosted coding agent that works in its own sandbox (Rush), a data tool with a built-in Python sandbox (Ploti) and two pay-per-call code runners (cdbx.ai and execbox.xyz). 5 were scored. All 5 require sign-in before listing their tools, which caps readiness, and scores range from 43 to 76 out of 100. 2 opted out of checks through robots.txt. None of the big platforms compared above lists a public MCP endpoint in the catalogs we crawl. We also track 9 pre-execution guardrail tools.
Sources: dartzdabz.com/api/tools.json · dartzdabz.com/api/counts.json · dartzdabz.com/directory/category/security
| Tool | Type | Score (grade) | Sign-in required | Last checked |
|---|---|---|---|---|
| Celesto Cloud Computers | MCP server | 76 (C) | Yes | 2026-10-19 |
| BoxCompute | MCP server | 70 (C) | Yes | 2026-10-19 |
| Ploti | MCP server | 70 (C) | Yes | 2026-10-19 |
| Everpod | MCP server | 49 (F) | Yes | 2026-10-19 |
| Rush | MCP server | 43 (F) | Yes | 2026-10-19 |
| mcp-server | MCP server | Opted out via robots.txt | not published | 2026-10-19 |
| execbox.xyz execute | x402 API | Opted out via robots.txt | not published | 2026-10-19 |
| Tool | Type | Score (grade) | Sign-in required | Last checked |
|---|---|---|---|---|
| sqlpermit.schemasure.com sql | x402 API | 100 (A) | No | 2026-10-19 |
| Overwing | MCP server | 90 (A) | No | 2026-10-19 |
| api.clawinabox.xyz check | x402 API | 90 (A) | No | 2026-10-19 |
| governance-platform | MCP server | 81 (B) | No | 2026-10-19 |
| gateway | MCP server | 57 (D) | Yes | 2026-10-19 |
| SkillAudit | MCP server | 46 (F) | Yes | 2026-10-17 |
| SpecLock - AI Constraint Engine | MCP server | 46 (F) | Yes | 2026-10-17 |
| humanmirror.fr safe-preflight | x402 API | 31 (F) | No | 2026-10-19 |
| Fullmakt | MCP server | Opted out via robots.txt | not published | 2026-10-19 |
Scores are automated, single-point checks, not endorsements. A sign-in requirement lowers readiness because we can't list a server's tools.
AI agent sandbox FAQ
What is the difference between a container and a microVM sandbox?
A microVM is a small virtual machine with its own kernel, so code inside is separated from the host by a VM barrier. Firecracker says it gives that barrier with container-like speed and density. Modal, for example, offers gVisor, a hardened container runtime, or a VM runtime with its own Linux kernel.
What are the main E2B alternatives?
Managed options include Daytona, Modal, Vercel Sandbox, Cloudflare's Sandboxes and Docker's cloud sandboxes. If you want to self-host, you can build on Firecracker directly or run Perplexity's open-source SPACE.
How long can an AI agent sandbox run?
It depends on the vendor and plan. E2B allows 1 hour of continuous runtime on Hobby and 24 hours on Pro, Vercel 45 minutes on Hobby and 24 hours on Pro, and Modal 5 minutes by default up to 24 hours. Daytona auto-stops after 15 idle minutes by default, which you can turn off.
Does Claude Code have a sandbox?
Yes, a built-in OS-level sandbox for shell commands, but it is off by default; turn it on with /sandbox. It doesn't cover Claude's file tools or MCP servers, so Anthropic suggests a container or VM for a boundary around the whole process.
Can a sandbox stop prompt injection?
No. A sandbox limits what injected instructions can damage, but the agent can still misuse any tool or credential you give it. OWASP's fixes are least privilege, narrow tools and human approval for high-impact actions.
Is Docker enough to sandbox an AI agent?
Docker's dedicated Docker Sandboxes product runs coding agents in microVMs and keeps credentials on the host. Claude Code's docs note that docker isn't compatible with its own sandbox mode, so decide which boundary each tool sits behind.
Are sandbox tools listed in the DartzDabz directory?
Yes: 7 sandbox or code-execution tools as of Oct 19, 2026, each with a daily trust score where we could check it. All 5 scored ones require sign-in, which lowers their readiness score.
Related: browse the agent tool directory · security and identity tools · real agent setups you can copy · submit a sandbox or safety tool · get the free DartzDabz newsletter · MCP servers behind OAuth · what is an MCP server? · today's AI agent brief
Sources
- E2B docs (overview; billing/limits: Hobby 1 h, Pro 24 h max continuous runtime) (checked 2026-10-19)
- Daytona docs: Sandboxes (checked 2026-10-19)
- Modal docs: Sandboxes (checked 2026-10-19)
- Vercel Sandbox docs (checked 2026-10-19)
- Vercel Sandbox pricing and quotas (checked 2026-10-19)
- Cloudflare Sandboxes docs (checked 2026-10-18)
- Docker Sandboxes docs + architecture (checked 2026-10-18)
- Firecracker project site (checked 2026-10-19)
- Claude Code docs: sandboxing (checked 2026-10-19)
- OWASP LLM06:2025 Excessive Agency (checked 2026-10-19)
- OWASP AI Agent Security Cheat Sheet (checked 2026-10-19)
- OWASP Top 10 for Agentic Applications announcement (Dec 9, 2025) (checked 2026-10-19)
- OWASP Top 10 for Agentic Applications 2026 (PDF; ASI05 text read via search index excerpt) (checked 2026-10-19, excerpt only)
- MarkTechPost: Perplexity open-sources SPACE (Oct 16, 2026; third-party summary of Perplexity's posts and red-team report) (checked 2026-10-19)
- DartzDabz tools.json and counts.json (Oct 19, 2026 build) (checked 2026-10-19)
- Perplexity, 'Escaping SPACE: Part I' (published Sep 23, 2026) (checked 2026-10-19)
Get the free DartzDabz newsletter
Free email with new and notable agent tools, the biggest trust-score changes, a rising trend, and one setup you can copy. No spam; unsubscribe anytime.