Sandbox.

/ Where agents run code.

Compute sandboxes for AI agents — microVMs, containers, and snapshot architectures that let agents run code, browse the web, and persist state without crashing each other or the host.

◆46 vendors·Last update 2026-05-18

/ tab

Timeline(35)Trend(10)Sandboxes data(46)Companies(10)Founders(54)Market data(7)

/ Context · Seven segments

How the AI sandbox market organizes itself

●7 segments
▲Classified by where compute lives
▼From cloud to local

/ Cloud Agent ExecSEG · 01

Cloud Agent Code-Execution Sandboxes

▸ Managed compute for agent-generated code · the hot lane

22 vendors ↓

/ Computer UseSEG · 02

Computer-Use / Desktop Sandboxes

▸ Full desktop / browser worlds agents can drive

3 vendors ↓

/ Cloud Dev EnvSEG · 03

Cloud Development Environments

▸ Reproducible dev environments · humans first, agents next

4 vendors ↓

/ Local / On-MachineSEG · 04

Local / On-Machine Sandboxes

▸ Host-level isolation · CLI, libkrun, bwrap

6 vendors ↓

/ Browser / WASMSEG · 05

Browser-Side / WebAssembly Sandboxes

▸ Code in the tab · isolates, WebContainers, V8

3 vendors ↓

/ Multi-Provider SDKSEG · 06

Multi-Provider Sandbox SDKs

▸ One interface, N runtimes underneath

2 vendors ↓

/ Serverless / FlowSEG · 07

General Serverless / Workflow Platforms

▸ Adjacent — not sandbox-first but used for compute

6 vendors ↓

/ NextNEXT · →

Open the full atlas

Vendor cards46
Timeline events35
Founder profiles54

View directory

/ Cross-segment observations

/ Concentration

Half the market is one shape

22 of 46 vendors ship the same product — a remote, ephemeral, Firecracker- or gVisor-isolated sandbox optimized for agent code execution. Commoditization pressure lives here; differentiation drifts to GPU, cold-start, snapshot.

/ Convergence

Firecracker is the de facto standard

≈18 vendors use Firecracker microVMs, often paired with KVM. gVisor a distant second (Beam, Modal, Northflank, Open Sandbox Alibaba). WebAssembly is the only architecturally distinct alternative with traction.

/ Underserved

Local sandboxes — real cluster, fragmented

Six independent local-execution vendors all launched in 2024–2026, mostly OSS. Demand from coding-agent users who want OS-level isolation without a third-party cloud. Near-term M&A or category-leader opportunity.

/ Bundling risk

Hyperscalers reshape segment 01

Cloudflare, Vercel, Deno, Modal — all bundle sandboxing with an existing developer platform. They don't need to win on sandbox features; they win on default integration. Pure-plays face an observability-vendor-style bundling risk.

/ Per-segment breakdown

SEG · 01

/ Cloud Agent Exec

Cloud Agent Code-Execution Sandboxes

▸ Managed compute for agent-generated code · the hot lane

Managed cloud services whose primary product is a per-call or per-session sandbox optimized for AI agents to execute generated code, run tools, or evaluate outputs. Typically ephemeral, microVM- or gVisor-isolated, accessed via SDK + REST, billed by usage.

22 vendors

Anyframe
microVM-per-frame cloud SaaS for Claude Code / Codex CLI / Cursor
Beam
gVisor/runc cloud sandbox with GPU (A10G, RTX 4090, H100), per-ms billing
Blaxel
Firecracker microVMs, sub-25ms standby resume, 16 regions
Castari
+SEG 06
Agent sandbox built on E2B; TS / Claude Agent SDK only
Cloudflare Sandbox
+SEG 07
Per-sandbox container in Cloudflare Workers; 300+ edge locations
Daytona
Container sandboxes with sub-90ms cold start, warm pools, GPU SKUs
Deno Sandboxes
Firecracker sandboxes inside Deno Deploy; JS/TS + Python, CPU-only
e2b
Canonical Firecracker code-interpreter sandbox; hybrid managed + BYOC
Hopx
Firecracker by Bunnyshell, ~100ms cold start, pay-per-use
Instavm
Firecracker SaaS, sub-200ms cold start; Python/JS/Bash SDKs
Ix
Snapshot-forking VMs on AMD EPYC Zen 5 bare-metal; ~26ms spin-up
LangSmith Sandboxes
HW-virtualized microVMs tightly coupled to LangChain; GPU on roadmap
Modal Sandboxes
+SEG 07
gVisor sandboxes inside Modal's serverless GPU platform (T4 → B200)
Open Sandbox (Alibaba)
+SEG 02
Alibaba OSS sandbox with gVisor/Kata/runc; Apache 2.0
Polarity
Firecracker-default (Docker fallback) sandboxed eval for agents
Runloop
+SEG 03
Ephemeral micro-VMs with container layer, deploy-to-VPC option
Sandflare
Firecracker by PandastackIO with userfaultfd snapshot/restore; Agent Forking
Sprites
Firecracker sandboxes via Fly.io APIs, per-second billing
Superserve
Per-agent / per-tool-call Firecracker; CIDR+domain network policies
Tensorlake
Firecracker with GPU SKUs (a16z-backed, acquired Upstash)
Upstash Box
Docker-based serverless sandbox with auto-pause; now under Tensorlake
Vercel Sandbox
+SEG 07
Firecracker on Amazon Linux 2023; sub-second cold start, OSS SDK

SEG · 02

/ Computer Use

Computer-Use / Desktop Sandboxes

▸ Full desktop / browser worlds agents can drive

Sandboxes whose first-class surface is a full desktop, GUI, or browser environment — the agent is expected to use a computer, not just call APIs.

3 vendors

Agentcomputer
+SEG 01
Firecracker hosted "computers" for agents, $20/mo flat, OSS self-host
Cua
+SEG 04
Apple Virtualization via Lume; macOS/Linux/Windows/Android sandboxes
OpenComputer
KVM VMs with hibernate/wake; ~300ms resume; hybrid managed + OSS

SEG · 03

/ Cloud Dev Env

Cloud Development Environments

▸ Reproducible dev environments · humans first, agents next

Hosted, longer-lived dev workspaces oriented toward humans (and increasingly agents) writing, running, and previewing code.

4 vendors

CodeSandbox
Firecracker CDE with Sandpack SDK, 500ms P95 snapshot resume
Diploi
Kubernetes-based always-hot dev/staging/prod; no cold starts
Exe.dev
KVM persistent VMs with disks, IAM, TLS/DNS; 9 regions
Namespace
+SEG 01
Bare-metal microVM dev/CI infrastructure; NEA-backed

SEG · 04

/ Local / On-Machine

Local / On-Machine Sandboxes

▸ Host-level isolation · CLI, libkrun, bwrap

Sandboxes that execute on the developer's own machine (or BYO infra), wrapping local coding agents or providing OS-level isolation primitives.

6 vendors

Fence Sandbox
OS-level sandbox wrapping any CLI agent (sandbox-exec + bubblewrap/Landlock)
microsandbox
libkrun MicroVM, self-hosted-only OSS; TS/Rust/Python SDKs
Nono
Local Landlock + Seatbelt sandbox by Sigstore creator Luke Hinds
Runtm
Local OS sandbox + bring-your-own-cloud Docker deploy
SmolMachines
libkrun VM-per-workload CLI; KVM + Hypervisor.framework; from Fly.io
SuperHQ
Local-first macOS app using Apple Virtualization.framework; real VM isolation

SEG · 05

/ Browser / WASM

Browser-Side / WebAssembly Sandboxes

▸ Code in the tab · isolates, WebContainers, V8

Sandboxes whose execution happens client-side — in the user's browser via WebAssembly, or in V8/WASM isolates — without a remote VM.

3 vendors

Rivet
V8 isolates / WebAssembly agent OS, ~6.1ms cold start; hybrid
StackMachine
Wasmer-powered WebAssembly sandbox with <5ms restore; global edge
WebContainers
Full Node.js runtime in-browser via WASM; client-side only

SEG · 06

/ Multi-Provider SDK

Multi-Provider Sandbox SDKs

▸ One interface, N runtimes underneath

Vendors that don't own underlying sandbox infrastructure but expose a unified SDK across multiple providers in this market.

2 vendors

Cased
Provider-agnostic Python lib wrapping E2B, Modal, Daytona, Vercel, Fly.io
ComputeSDK
Provider-agnostic JS/TS + Python SDK; 8 providers including Blaxel

SEG · 07

/ Serverless / Flow

General Serverless / Workflow Platforms

▸ Adjacent — not sandbox-first but used for compute

Broader compute or workflow platforms whose primary product is not a sandbox, but which ship a sandbox SKU — often added in response to AI agent demand.

6 vendors

Depot
+SEG 01
Docker-build acceleration + agent sandbox SKU; YC W23, $14.1M
Freestyle
+SEG 01
KVM full-VM sandbox + serverless deployments; Landlock isolation
Judge0
Long-running OSS code-execution judge (Isolate + Docker), 60+ languages
Koyeb
Serverless containers with GPU; acquired by Mistral AI Feb 2026
Northflank
+SEG 01
Multi-runtime serverless platform (Firecracker/Kata/gVisor); BYOC
Windmill
OSS workflow platform with AI Sandboxes (nsjail); 16,470 stars