Some work needs a real machine
Most agent work is a model call and a tool call, and neither needs a kernel. But some genuinely does: writing files, running a build, using a shell, cloning a repository. For that, an isolate is not enough — you need a real filesystem and a real process tree.
So the design question is not whether to have a sandbox. It is how small a share of the fleet ever needs one, and how quickly it can be given up once the work is finished.
Isolation and idle cost pull against each other
A sandbox is a container, and a container sleeps on a timer rather than on a condition. It cannot know that the work is over; it can only notice that nothing has happened for a while. That means every burst of work is followed by a tail you pay for.
The stronger the isolation, the longer that tail tends to be, and the more the economics resemble a machine you rent by the hour. This is the part of an otherwise serverless design that behaves least like one, and we would rather say so than let it be discovered later.
What we are trying to establish
Whether untrusted code can be given a real kernel without a standing host; what fraction of real agent work actually reaches for one; and whether a sandbox can be handed back fast enough that the tail stops mattering. All three are open.
- Status
- Research
- Focus
- Cost per box-second
- Surface
- Early / evolving
- Papers
- Findings land on /lab/papers when gated