--- title: The sandbox became the unit of agent compute description: Modal runs 40 million gVisor containers a day. Cursor moved its agents to the cloud. The question is no longer whether to sandbox agents, but which shape of sandbox fits the work. canonical: https://hangingcontext.com/stories/2026-11-12/sandbox-is-agent-compute-unit/ last-updated: 2026-11-12 url: https://hangingcontext.com/stories/2026-11-12/sandbox-is-agent-compute-unit/ published: 2026-11-12T01:17:09Z edition: 2026-11-12T00 newsroom: artificial-intelligence beat: infrastructure trust: confirmed source_count: 4 cited_manifest_ids: ['1794440498777504617', '1794435601523486339', '1794435601523486338', '1794429916970459067'] --- # The sandbox became the unit of agent compute *Modal runs 40 million gVisor containers a day. Cursor moved its agents to the cloud. The question is no longer whether to sandbox agents, but which shape of sandbox fits the work.* Confirmed · 4 Manifests · Artificial Intelligence · Published 2026-11-12 01:17 UTC ## Key facts - Modal launches upwards of 40 million gVisor containers a day, and about 670k gVisor containers are restored from a snapshot each day at Modal. (self-reported) [cites: 1794440498777504617] - gVisor can boot a sandbox in about 25 ms with 12 MB of memory overhead. (self-reported) [cites: 1794440498777504617] - Cursor has rebranded its Background Agents to Cloud Agents, which run in isolated virtual machines rather than on the user's local machine. (self-reported) [cites: 1794435601523486339] - Article 57 of the EU AI Act requires each member state to set up at least one AI regulatory sandbox by 2 August 2026. (self-reported) [cites: 1794435601523486338] ## The isolation layer goes mainstream Modal has committed to join gVisor's maintainers, as Google is donating the gVisor project to the Cloud Native Computing Foundation. Modal has been a contributor to gVisor since 2023, and aims for gVisor to become the default isolation layer for AI compute. The scale is the argument: Modal launches upwards of 40 million gVisor containers a day, and about 670k gVisor containers are restored from a snapshot each day at Modal. [cites: 1794440498777504617] gVisor adds a separate application kernel called the Sentry between the container and the host, and can boot a sandbox in about 25 ms with 12 MB of memory overhead. Modal has upstreamed support for NVIDIA driver releases and newer GPUs like Blackwell and RTX PRO 6000, and built rdmaproxy to enable multi-node training inside gVisor sandboxes. Modal is developing multi-GPU memory snapshots as an experimental feature, and is working on bringing GPUDirect Storage to gVisor. [cites: 1794440498777504617] The point is density. A sandbox that boots in about 25 ms with 12 MB of overhead can be spun up per task, per agent, per evaluation, and thrown away. That is the shape agent compute needs: disposable, fast, and cheap enough to use once. The maintainer move, with Google donating the project to the CNCF, turns a Google project into shared infrastructure, which is what happens when a technology stops being a differentiator and starts being a utility. [cites: 1794440498777504617] > **From Synorb** — Run the cited Manifests yourself. Every claim in this paper points to a Manifest id. Get a Synorb Key and read the Manifests behind it. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons. [Get a key](https://synorb.com/connect/start) ## Sandbox or cloud computer An AI sandbox is an isolated environment where an AI model or agent can run code, open files or browse without touching the systems around it. Sandboxes use different isolation layers including containers, gVisor, Firecracker microVMs, and WebAssembly. But the shape matters: when the work has to persist, keep logins, or be shared between several agents, a sandbox is usually the wrong shape and a cloud computer for AI agents fits better. [cites: 1794435601523486338] E2B provides open-source sandboxes on Firecracker microVMs, and Daytona offers sandboxes for agents, evaluations, and training with persistence by default and GPU support. Modal provides containers created from code on a serverless platform with GPU availability, and Claude Code can sandbox bash commands with OS-level file and network limits. Box is a cloud computer for AI agents that maintains files, apps, and logins between tasks, and Box pricing starts at $0.10 per hour or $19 per month. [cites: 1794435601523486338] The rule of thumb is clean. Sandboxes are the correct choice when every run should start clean, whereas cloud computers are required when an agent's value depends on persistent state. Evaluations, untrusted code, and disposable tasks belong in a sandbox. Long-running work with logins and shared files belongs in a cloud computer. The mistake is using the wrong shape for the job. [cites: 1794435601523486338] ## The agents move to the cloud Cursor has rebranded its Background Agents to Cloud Agents, and the rebrand is a move, not a rename. Cloud Agents run in isolated virtual machines rather than on the user's local machine, and continue to operate after the user closes the Cursor application. Cloud Agents support multi-repository environments, and support GitHub, GitLab, Bitbucket, and Azure DevOps. Cloud Agents can be initiated from Slack, Linear, and the Cursor API, and can be configured using Dockerfiles. [cites: 1794435601523486339] The persistent side is covered by integrations. Simular Box provides a persistent Linux desktop environment for AI agents, and connects to Cursor as an MCP server. Cloud Agents can use the VM's desktop and browser for testing, and support private network connectivity via Tailscale. Simular Box pricing starts at $0.10 per hour. The pattern is the same as the sandbox story: the agent gets an isolated machine, the machine gets a persistent desktop when the work needs it, and the developer's laptop stops being the bottleneck. [cites: 1794435601523486339] ## Visibility and the regulator The infrastructure underneath all of this has a visibility problem. Teams deploying AI workloads using NVIDIA Dynamo, Kubeflow, or Slurm face challenges in tracking actual runtime execution, and platform recipes alone are insufficient for tracking AI workloads because application teams update them independently. NVIDIA DSX AI Factory provides runtime AI inventory to validate GPU platforms, tracking what is actually running rather than what the recipe says should be running. [cites: 1794429916970459067] Regulators are converging on the same shape. Article 57 of the EU AI Act requires each member state to set up at least one AI regulatory sandbox by 2 August 2026, to facilitate supervised testing of AI products. The regulatory sandbox and the technical sandbox share a name for a reason: both are isolated environments where something untrusted can run safely while someone watches. The industry is standardizing on the sandbox as the unit. The regulators are standardizing on it too. [cites: 1794435601523486338] ## What is still unresolved - Whether gVisor becomes the default isolation layer, or whether Firecracker microVMs keep their share. - How much of agent work ends up in persistent cloud computers versus disposable sandboxes. - Whether runtime inventory tools like DSX close the visibility gap for multi-team GPU platforms. ## Decision card - **Useful for:** developers running untrusted agent code; teams choosing agent infrastructure - **Not for:** anyone running a single local agent - **Compare against:** running agents on a local machine; full virtual machines per agent ## Provenance ledger | Manifest id | Title | Source | Claims used | Published | |---|---|---|---|---| | `1794440498777504617` | Modal becomes a gVisor maintainer | [modal-labs-blog](https://modal.com/blog/modal-gvisor-maintainer) | 1794440912423505077, 1794440912432505083, 1794440912426505079, 1794440912418505075, 1794440912421505076, 1794440912427505080, 1794440912433505084, 1794440912424505078, 1794440912429505081, 1794440912431505082, 1794440912435505085, 1794440912436505086 | 11-11 00:00 | | `1794435601523486339` | Cursor background agents (now Cloud Agents): how they work in 2026 | [simular-ai-blog](https://simular.ai/articles/cursor-background-agents) | 1794435929644488404, 1794435929647488405, 1794435929650488407, 1794435929651488408, 1794435929652488409, 1794435929659488414, 1794435929654488410, 1794435929655488411, 1794435929658488413, 1794435929657488412, 1794435929661488415 | 11-11 00:00 | | `1794435601523486338` | Sandbox AI: what an AI sandbox is, and when your agent needs a computer instead | [simular-ai-blog](https://simular.ai/articles/sandbox-ai) | 1794435929112488249, 1794435929108488246, 1794435929115488252, 1794435929117488254, 1794435929111488248, 1794435929118488256, 1794435929120488257, 1794435929121488258, 1794435929114488251, 1794435929123488260 | 11-11 00:00 | | `1794429916970459067` | Validating GPU Platforms with Runtime AI Inventory via the NVIDIA DSX AI Factory | [nvidia-developer-blog](https://developer.nvidia.com/blog/validating-gpu-platforms-with-runtime-ai-inventory-via-the-nvidia-dsx-ai-factory) | 1794430191895459991, 1794430191898459992, 1794430191899459993 | 11-11 00:00 | ## Run these Manifests yourself Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them. 1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons. 2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer `. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief. 3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them. Cited Manifest ids: - `1794440498777504617` - `1794435601523486339` - `1794435601523486338` - `1794429916970459067` ```sh for id in 1794440498777504617 1794435601523486339 1794435601523486338 1794429916970459067; do curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id" done ``` > **From Synorb** — Connect your agent over MCP. Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network. [How to connect](https://synorb.com/connect/start) ## Related stories - [Robot learning stopped arguing about policies and started arguing about data](https://hangingcontext.com/stories/2026-11-12/robot-learning-data-pipeline-corl/) - [Fable, GLM and Hy4 landed in the same week. The test that matters is the one you run yourself](https://hangingcontext.com/stories/2026-11-12/new-models-week-fable-glm-hy4/) - [Your agent's memory is now the product. The question is whether it remembers true things](https://hangingcontext.com/stories/2026-11-12/agent-memory-becomes-the-product/) - [Your weekly limit is not the problem. Your model mix is](https://hangingcontext.com/stories/2026-11-11/model-choice-is-now-a-budget-decision/) ## Links - HTML: https://hangingcontext.com/stories/2026-11-12/sandbox-is-agent-compute-unit/ - JSON: https://hangingcontext.com/stories/2026-11-12/sandbox-is-agent-compute-unit/index.json - Markdown: https://hangingcontext.com/stories/2026-11-12/sandbox-is-agent-compute-unit/index.md Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify. --- Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-11-12/sandbox-is-agent-compute-unit/. Terms: https://hangingcontext.com/terms/reuse/