Run untrusted code with Vercel Sandbox, now generally available

AI agents need secure, isolated environments that spin up instantly. Vercel Sandbox is now generally available with filesystem snapshots, container support, and production reliability.

V

VercelVercel

·January 30, 2026

Run untrusted code with Vercel Sandbox, now generally available

Agent workloads demand a different kind of compute

AI agents don't interact with infrastructure the way humans do. They clone repositories, install dependencies, execute tests, and iterate in rapid cycles. Most compute platforms were designed for human workflows: provision an environment, configure it, use it for a while, then tear it down. Agents need a fundamentally different model — secure, isolated environments that boot in milliseconds, run code from untrusted sources, and vanish the moment the job finishes.

Vercel is addressing this with the general availability of Vercel Sandbox, its execution layer for AI agents. The company is also open-sourcing the Sandbox CLI and SDK so developers can build on the same infrastructure.

From deployment pipeline to agent runtime

The infrastructure behind Sandbox is not new. Vercel handles over 2.7 million deployments daily, each involving an isolated microVM that runs code and is destroyed, often within seconds. To support this scale, Vercel built its own compute platform, internally called Hive. It relies on Firecracker and orchestrates microVM clusters across multiple regions. Every time you hit Deploy in v0, import a repo, clone a template, or run the vercel CLI command, Hive is the engine making it feel instantaneous. Sandbox extends this same platform to agent execution.

Ephemeral, isolated microVMs

Vercel Sandbox provisions on-demand Linux microVMs. Each sandbox runs with its own filesystem, network stack, and process space, fully isolated from other workloads. You get sudo access and can run any command you'd run on a standard Linux machine, including package manager operations.

import { Sandbox } from '@vercel/sandbox';
const sandbox = await Sandbox.create();
await sandbox.runCommand({
  cmd: 'node', 
  args: ["-e", 'console.log("Hello from Vercel Sandbox!")'],
  stdout: process.stdout,
});
await sandbox.stop();

The design is intentionally ephemeral. Sandboxes execute for as long as a task requires, then shut down automatically. Billing is based on active CPU time, not idle time, which aligns with the bursty nature of agent work — a single task can trigger dozens of start, run, and teardown cycles.

The architecture also supports key requirements for agent workloads:

Sub-second starts to spin up thousands of sandboxes per task
Full isolation for untrusted code from repos and user input
Ephemeral environments that live only as long as needed
Snapshots to restore complex environments instantly instead of rebuilding them
Fluid compute with Active CPU pricing to balance cost and performance

Snapshots make agents stateful collaborators

Roo Code builds AI coding agents that operate across Slack, Linear, GitHub, and its web interface. Instead of returning patches, Roo Code agents produce a running application you can actually interact with. Vercel Sandbox gives these agents a complete environment where services run together, letting the agent test changes end-to-end before handing anything over for review.

"The agent operates inside a complete environment where services can run together, so it can test changes end-to-end before handing you something to review. Instead of 'review a patch and hope,' you get a preview you can engage with as the agent iterates."

Matt Rubens, CEO, Roo Code

Snapshots have been transformative for Roo Code's architecture. Rather than starting every run from scratch — re-cloning repos and reinstalling dependencies — the team snapshots an environment and restores it to a known state on later runs. This turns agents from stateless executors into persistent collaborators capable of resuming complex tasks across days or exploring parallel approaches from a shared starting point.

"Snapshots turn agents from stateless workers into persistent collaborators. Start a task on Monday, snapshot it, resume Thursday when stakeholders can review. Branch from a working state and try two approaches in parallel."

Matt Rubens, CEO, Roo Code

Parallel agent orchestration at scale

Blackbox AI developed Agents HQ, an orchestration platform that unifies multiple AI coding agents behind a single API. The platform executes tasks inside Vercel Sandboxes, and the choice came down to two performance criteria: infrastructure stability and cold start latency.

"The decision to standardize on Vercel's sandbox infrastructure was driven by two critical performance metrics: infrastructure stability and cold start performance. Sub-second sandbox initialization times enabled rapid task distribution and reduced end-to-end execution latency, which proved essential for production-grade agent orchestration."

Robert Rizk, Co-founder and CEO, Blackbox AI

The result is horizontal scaling for concurrent execution. Blackbox dispatches tasks to many agents in parallel, each isolated in its own sandbox, without contention over shared resources.

"By using Vercel sandboxes to let users run AI agents at scale, we enable organizations to treat AI agents as reliable, scalable compute primitives within their development and production systems."

Robert Rizk, Co-founder and CEO, Blackbox AI