AI Agent Sandboxes Compared: 15 Providers on Isolation, Persistence, Agent Tooling, and Cost (2026)

This post compares 15 popular AI agent sandbox providers side by side, from the same angles for each: capabilities, agent-native features, deployment, developer experience, and cost. Every row has a source at the end.

At a glance

What each column is telling you:

Isolation is three designs, not a ranking: a VM with its own kernel, gVisor's userspace kernel, or a hardened container. Most providers run a VM and a box is a container, so this is where Box is the weaker choice if you need a kernel per tenant.

Cold start is what vendors lead with and what matters least, since booting is a fraction of the time a task spends cloning, installing, and calling a model. The figures are not like for like: they mix create-to-first-command, resume-from-standby, and time-until-an-agent-connects, and each is the vendor's own claim except the Box row, which we measured with five runs from Europe.

Billing basis is the one that surprises people at scale. Wall-clock charges for every second the sandbox is up, including the minutes it waits on a model; active CPU charges only for what the code burns, and only Box also leaves memory free.

Idle cost is what you pay between sessions, usually storage for the saved disk. Providers with no pause state keep charging the full rate until the sandbox is deleted.

Session cap is easy to miss until it bites: an hour is fine for a code interpreter, wrong for a long task, and the longer cap is often a paid plan away. Seven of the fifteen, Box included, have no cap at all.

What survives a pause decides how you structure a session: filesystem only means restarting processes, memory as well means a loaded model is still there, nothing means starting from a snapshot each time. Box, E2B, Vercel, Blaxel, and Tensorlake are the ones built around pausing and coming back.

Agent built in separates platforms that run an agent behind an API you call with a prompt from those that only let you install one. "CLIs preinstalled" is the middle ground; Box and Runloop are the only two on the yes side.

Capabilities

Snapshot / fork makes parallel work cheap: set up once, snapshot, then start ten sandboxes from that state. Whether it carries memory as well as disk decides whether those ten start warm or cold, and Box snapshots are disk-only but keep the agent configuration.

Custom images move setup to build time. Most providers take any Docker image or Dockerfile; Box offers per-runtime images plus snapshots today, with custom images planned.

Egress control is the column to read closely if the sandbox runs code you did not write. Almost every provider starts open, Freestyle is the only one that starts closed, and Box, E2B, Vercel, and Beam let you change the policy on a running sandbox.

Built-in tooling is the gap between a machine and a runtime. Most providers stop at a code interpreter; Box is at the other end, which the next section breaks down.

GPUs inside the sandbox: Modal, Daytona, Beam, Northflank, and Koyeb. Box, E2B, Blaxel, Namespace, and Sprites are CPU-only.

Agent-native features

A sandbox that only runs commands leaves you to build the agent loop, the git flow, the browser, the scheduler, and the secret handling yourself. These columns are what turn a sandbox into an agent runtime.

Run a coding agent with one call has three levels: you bring the agent, the CLIs are preinstalled and you parse stdout, or the platform runs the process for you. Only Box returns it as a method call with a typed result.

Typed output lets one agent's answer feed the next step without a parser in between. Box takes a Zod or Pydantic schema in the SDK and returns a validated object; elsewhere it comes from the agent or framework you run inside.

Scheduled runs in the sandbox suit agents that work on a cadence rather than on a request. Only Box has cron inside the sandbox; Blaxel, Beam, and Northflank schedule at the platform level.

Secrets kept off the sandbox matters because the obvious approach is the unsafe one: an environment variable is readable by the code the model just wrote. A host-side proxy that injects the credential keeps it out of reach, which Box does with Attach Headers.

Managed browser decides whether web work is a feature or a Chromium install you maintain. Box, E2B, and Runloop ship one; Daytona and Tensorlake give you a VNC desktop instead.

Git-to-PR helper is the difference between a finished task and a diff sitting in a container. Several providers wrap git operations, but only Box opens the pull request.

MCP is two questions in one heading: driving the sandbox from an MCP client, and giving the agent inside MCP tools. Box and Runloop are the only two that do both.

The practical test for this table is how much code a full task takes. Clone, branch, run the agent, commit, push, open the pull request, with the run's cost attached:

import { Agent, Box } from "@upstash/box"
 
const box = await Box.create({
  runtime: "node",
  agent: { harness: Agent.ClaudeCode, model: "anthropic/claude-fable-5" },
  git: { token: process.env.GITHUB_TOKEN },
  attachHeaders: { "api.stripe.com": { Authorization: `Bearer ${process.env.STRIPE_KEY}` } },
})
 
await box.git.clone({ repo: "https://github.com/your-org/your-repo", branch: "main" })
await box.cd("your-repo")
await box.git.exec({ args: ["checkout", "-b", "fix/null-token"] })
 
const run = await box.agent.run({ prompt: "Fix the null-token bug in src/auth.ts and add tests" })
 
await box.git.commit({ message: "fix: handle null token in auth" })
await box.git.push({ branch: "fix/null-token" })
const pr = await box.git.createPR({ title: "Fix null token bug", base: "main" })
 
console.log(pr.url, run.cost.totalUsd)

On providers without the git and agent helpers, the same flow is your own code around exec: shell out to git, stream the agent's output, parse it, then call the GitHub API yourself.

Deployment

Hosting rules providers out rather than ranking them. For your own cloud account the list is Northflank, E2B (Enterprise), Tensorlake, Beam, Daytona, and Blaxel; Box is managed-only.

Regions is the same kind of hard filter. If data has to stay in the EU it is E2B (Pro), Daytona, Modal, Vercel, Blaxel, and Koyeb; Box is us-east-1 only.

Compliance is where you read the scope rather than the badge. Most of these cells describe the parent company's certification, not an audit scoped to the sandbox.

Developer experience

SDKs decide whether the sandbox fits your stack without a REST wrapper of your own. TypeScript and Python are near-universal; Cloudflare is TypeScript-only.

Documented framework integrations show how much glue the provider has already written and tested. The Vercel AI SDK, LangChain, and the OpenAI Agents SDK are the common ones; Northflank and Freestyle document none.

Concurrency is a plan limit rather than a technical one. Free tiers sit around 10 to 30 and paid ceilings vary by three orders of magnitude.

Cost

List prices, pay-as-you-go. Many providers have a plan with no monthly fee but gate features behind a paid one: E2B Pro ($150/mo) for 24h sessions, Runloop Pro ($250/mo) for suspend and resume, Namespace Team ($100/mo) for 5h instances, Tensorlake Pro ($250 per cycle, which includes $250 of usage) for the lower rates. Cloudflare needs the $5/mo Workers Paid plan. Freestyle's docs and pricing page disagree on whether persistent VMs need Hobby ($50/mo).

CPU and memory are the per-core-hour and per-GB-hour rates, and billing basis and idle cost repeat from At a glance because they decide whether those rates apply all hour or only to the busy seconds. Free tier is usually a one-off credit, not a monthly allowance.

The rate card is the wrong thing to compare. Agent work comes in bursts: the CPU is busy for a few seconds per tool call and idle while the model thinks. What matters is what you pay for the idle time.

One hour on a 2 vCPU / 4 GB sandbox with about 10 core-minutes of real CPU use, usage charges only, relative to Box's ~$0.017:

Examples, not quotes. Storage is excluded except where shown, as are egress and creation fees.

The spread is workload-shaped, so run the formulas on your own numbers before trusting the order. The more time the agent spends waiting on a model, the wider the gap between the two billing models gets. Saturate the CPU for the full hour and it mostly closes: Box, for instance, rises to about $0.20 and lands mid-table. A second thing the table hides is what you pay for the model itself, which every provider here leaves to you except Box, which meters it and includes a small monthly budget.

How to choose

Start with Upstash Box if you are building a coding agent, a per-user agent that lives for weeks, or any agent loop that waits on a model most of the time. It is the only row with every agent-native column filled in, it bills active CPU with memory free, and the free tier needs no card. Move to another provider when one of these applies:

1. A separate kernel per untrusted tenant. E2B, Vercel, Tensorlake, Freestyle, or Sprites. Modal and Beam use gVisor, a userspace kernel on a shared host kernel. Box and Daytona containers do not give you a separate kernel.
2. A GPU in the sandbox. Modal, Daytona, Beam, Northflank, or Koyeb.
3. Your own cloud. Northflank, E2B (Enterprise), Tensorlake, Beam, Daytona, or Blaxel (bring-your-own-metal).
4. State that must survive in RAM. E2B, Blaxel, Tensorlake, or Freestyle.
5. The sandbox has to live inside your platform. Vercel Sandbox, Cloudflare, or Modal.
6. Evals and compliance built in for coding agents. Runloop.
7. The cheapest wall-clock compute with your own agent. Northflank or Koyeb.

Try Box

import { Agent, Box } from "@upstash/box"
 
const box = await Box.create({
  runtime: "node",
  agent: { harness: Agent.ClaudeCode, model: "anthropic/claude-fable-5" },
})
 
const run = await box.agent.run({
  prompt: "Write a /health endpoint in server.js and start it on port 3000",
})
 
console.log(run.result, run.cost.totalUsd)

The free tier is 10 concurrent boxes, 5 CPU-hours a month, and a $1 model budget, with no card and no platform fee. The quickstart takes a few minutes.

Sources

Checked in September 2026. Compliance cells repeat what the provider states.

Upstash Box (pricing) · E2B (persistence, egress) · Daytona (isolation, persistence) · Modal (sandboxes, networking) · Vercel Sandbox (concepts, firewall) · Cloudflare (limits, outbound) · Runloop (lifecycle, Broker, CLI) · Blaxel (overview, bring-your-own-metal, Baseten) · Namespace (egress policy) · Beam (security) · Tensorlake (lifecycle) · Northflank (sandboxes) · Freestyle (limits) · Fly Sprites (lifecycle) · Koyeb (sandboxes, instances)

If a cell is out of date, open an issue or tell us on X. Providers ship changes every week, and we would rather fix a row than argue about it.