What is an AI agent sandbox?
An AI agent sandbox is an isolated computing environment where an AI agent can run code, install software and change files without being able to touch your own machine, your data or other customers' workloads. Because agents write and run code nobody has reviewed, the sandbox limits the damage when that code is wrong or malicious. Most are cloud services that start an environment through an API.
Why do AI agents need a sandbox?
An agent that only answers questions needs no computer. An agent that does work does: it clones repositories, installs packages, runs tests and starts servers. Running that on your laptop or production servers gives it your credentials and your files, and a prompt injection in a web page or a dependency can turn the agent against you. A sandbox keeps that code away from anything you care about.
What are the kinds of isolation?
| Kind | How it isolates | Trade-off |
|---|---|---|
| Container | Shares the host's kernel, separated by namespaces and cgroups | Light, but a kernel exploit can reach the host |
| gVisor | Intercepts system calls in a user-space kernel | Stronger than a container, with some compatibility and speed cost |
| MicroVM (such as Firecracker) | Runs its own kernel on a minimal virtual machine | Strongest of the three, and can run Docker inside; heavier than a container |
For code nobody has reviewed, a microVM is the safer default, since each agent gets its own kernel rather than sharing one.
What should I look for?
- Isolation: does each agent get its own kernel?
- Persistence: do files survive, and for how long? Some sandboxes are throwaway; others keep a disk.
- Pause and resume: can it suspend and keep memory and processes, so an idle agent stops costing CPU? Does it tell you when it couldn't?
- Session limits: is there a maximum run time? Long-running agents hit these first.
- Root and Docker: can the agent install anything and run containers?
- Network: can you publish a port as a URL, and control what it can reach?
- How agents reach it: a CLI, an API, SDKs, or an MCP server for coding agents.
- Billing model: allocated resources or actual use, and what idle time costs. See the pricing comparison.
Do I need a sandbox or a whole VM?
"Sandbox" often means a short-lived environment for one piece of code, such as a data analysis snippet. If your agent works for hours, keeps state between tasks or runs servers, you want something closer to a full computer that persists. Quivvo is that kind of product: each machine is a Firecracker microVM with root and a persistent disk, Docker on the default template, which suspends when idle and wakes on the next command.
Give your agent a computer
npx quivvo@latest sh