A curated list of sandboxing solutions for AI agents, organized by isolation layer.
Where applicable, each section links to the base technologies (isolation engines, runtimes) that underpin the listed sandboxes, in case you already have the platform plumbing and only need the engine itself.
Full or lightweight VMs provide the strongest isolation boundary and are the most common choice for running untrusted agent code at scale. Built on technologies like Firecracker, libkrun, and Cloud Hypervisor.
- E2B - Cloud sandbox platform powered by Firecracker microVMs for enterprise AI agents to safely execute code
- Sprites / Fly.io Sprites - Ephemeral Linux VMs secured through Firecracker with checkpoint/restore capabilities
- Vercel Sandbox - Ephemeral compute service executing untrusted code in isolated Firecracker microVMs
- yolo-cage - VM-based sandbox for AI coding agents that blocks secret exfiltration and prevents agents from merging their own PRs
- Matchlock - CLI running AI agents in ephemeral microVMs (Firecracker on Linux, Virtualization.framework on macOS) with network allowlisting
- Arrakis - Self-hosted microVM platform for AI agent code execution with checkpoint-and-restore functionality
- ERA - Local sandboxing using krunvm microVMs with container-like UX and optional Cloudflare Workers deployment
- Gondolin - QEMU-based microVMs booting in under a second with programmatic network and filesystem control
- Netclode - Self-hosted cloud coding agent using Kata Containers with Cloud Hypervisor microVMs
- Runloop - Enterprise AI infrastructure with dual-layer isolation (VM + container) for secure agent execution
- Vibe - Zero-configuration Debian Linux VMs on macOS using native Virtualization.framework for LLM agents
- exe.dev - Persistent SSH-accessible VMs with sudo access for development workflows
- Daytona - Secure infrastructure for running AI-generated code in cloud environments
- Modal - Serverless platform with ephemeral environments for running untrusted code at scale
OS-level isolation uses Linux namespaces, cgroups, or kernel-enforced policies; it is fast and flexible but shares the host kernel. Built on technologies like gVisor and LiteBox.
- Leash - Policy enforcement wrapper for AI coding agents with Cedar-based rules and real-time monitoring
- packnplay - Docker wrapper for AI assistants with automatic git worktree and devcontainer support
- yolobox - CLI running AI agents in containers where home directory stays unmounted for safety
- CodeRunner - Secure local sandbox to run LLM-generated code on macOS using Apple containers and MCP
- SandboxAI - Docker-containerized runtime for safely executing AI-generated Python and shell commands
- llm-sandbox - Python library executing LLM-generated code in Docker/Kubernetes/Podman with customizable security
- MCP Runner - MCP server platform using Docker with gVisor runtime for multi-tenant isolation
- PythonSafeEval - Python execution using nsjail process jail inside Docker containers
Jails and namespace-based tools restrict syscalls, filesystem, and network access for individual processes with minimal overhead. Built on technologies like Bubblewrap, runjail, and sydbox.
- Anthropic Sandbox Runtime - Lightweight sandboxing tool enforcing filesystem and network restrictions on arbitrary processes without requiring a container
Copy-on-write and virtual filesystem layers isolate agent changes from the host or workspace while keeping performance high.
- AgentFS - Copy-on-write sandboxing isolating file changes from original source tree
- LocalSandbox - Python SDK with SQLite-backed virtual filesystem for bash and Python execution
WebAssembly provides strong sandboxing inside a language runtime and is useful when you need embedding or portable execution. Built on technologies like Wasmtime and Pyodide.
- Wassette - MCP server runtime executing WebAssembly components with browser-grade tool isolation
- Capsule - Secure AI agent runtime executing tasks in isolated WASM sandboxes with resource limits
- Eryx - Rust library executing Python (CPython 3.14) in WebAssembly sandbox via Wasmtime
- AgentVM - Node.js library running WASM-based Alpine Linux in worker threads for shell execution
- amla-sandbox - WASM sandbox with capability enforcement preventing shell escapes and unauthorized access
In-process execution with strict capability controls but no OS boundary; best for lightweight tasks or trusted environments.
- Monty - Minimal Python interpreter in Rust with microsecond startup and strict capability controls
Contributions welcome! Please submit a PR to add new sandboxing solutions.