all posts
blog · topic

AI agent sandboxes

An agent that runs code, installs packages, or drives a browser needs somewhere to do it that is not your laptop or your production cluster. These posts cover how agent sandboxes work, what coding and browser agents actually need from one, how to scope tool permissions, and how to run many agents in parallel with a hardware-isolated microVM per session.

AI agent sandboxes on PandaStack

213 posts

·11 min read

Top 11 Ephemeral Development Environment Platforms (2026)

Every roundup in this category sorts by substrate or by price list. Both are downstream of a question nobody asks on the evaluation call: who, or what, is going to call create? Eleven platforms sorted by their creator — human, CI job, pull-request webhook, agent API — because the creator decides how many environments exist at once and who pays for the idle ones.

comparisondev-environmentsephemeral
Ajay Kumar
·11 min read

PandaStack vs Gitpod / Ona: A Workspace Is Not a Sandbox

Gitpod was right about disposable development environments before most of the industry agreed. The divergence is not quality, it is the unit: a workspace a person opens, versus a sandbox an API call creates and throws away 400 times.

gitpodonacomparison
Ajay Kumar
·11 min read

Top 6 Ephemeral Dev Environment Platforms for AI Agents

Every roundup of ephemeral development environments grades them for a human opening an IDE. This one grades them for an autonomous agent with no hands, no browser and no patience — six platforms, one rubric, including where mine loses.

comparisonai-agentsephemeral
Ajay Kumar
·11 min read

A Real Red-Green Loop for Coding Agents, One MicroVM per Attempt

The single highest-signal tool you can hand a coding agent is a test runner it can actually run. Here is the two-layer architecture that makes the loop fast enough to use, the output format a model can read, and the limits the loop exists to discover you forgot.

ai-agentstddtesting
Ajay Kumar
·10 min read

A Linux Desktop per Agent: Xvfb, VNC, and One MicroVM per Session

A computer-use agent driving a mouse over arbitrary websites needs a whole desktop, and the blast radius of that is a whole machine. Here is the Xvfb + x11vnc + noVNC stack, why it belongs in its own microVM, and the parts that have no GPU to save them.

ai-agentscomputer-usevnc
Ajay Kumar
·10 min read

Untrusted CAD: Running Customer (and Model-Generated) Geometry Scripts in a MicroVM

A product configurator, a 3D-print shop and an AI agent that emits parametric geometry all end up in the same place: executing a script that produces a solid. "We only run geometry scripts" is not a security property. It is a hope.

cadopenscadcadquery
Ajay Kumar
·11 min read

Audit Trails When the Machine Is Gone in 200 Milliseconds

The thing that makes a sandbox safe — it is destroyed — is exactly what makes "what did the agent do at 03:14?" unanswerable. You cannot keep the machine. You can keep its memory and disk.

audit-loggingforensicscompliance
Ajay Kumar
·8 min read

How to add human approval to agent code execution

The gate that asks about everything gets clicked through by Thursday. The useful design asks about almost nothing, because isolation earns you the right not to ask.

ai-agentshuman-in-the-loopsandbox
Ajay Kumar
·9 min read

The best AI agent guardrail tools in 2026, by layer

Most teams buy one guardrail product and think they're covered. The layers solve disjoint problems, and only one of them is deterministic.

ai-agentssecurityguardrails
Ajay Kumar

More posts in this topic