DEV Community

Cover image for 78ms Is All Untrusted Agent Code Needs: Sandboxes Compared for 2026
Moksh Gupta
Moksh Gupta

Posted on Originally published at devtoollab.com

78ms Is All Untrusted Agent Code Needs: Sandboxes Compared for 2026

#security #python #ai #devops

Letting a model write code is now routine. Letting that code run on the machine holding your credentials is the part nobody measured until it mattered. So I measured it: a Python snippet, executed the way most people execute agent output, enumerated 60 environment variables, a readable ~/.ssh, a readable ~/.aws, live outbound network, and write access outside its own directory. Elapsed time: 78 milliseconds.

That single number is the case for this whole product category, and it is also why the reflexive first defense fails. A timeout caps duration. It says nothing about reach. Five seconds is about 64 times longer than that reconnaissance needed.

I wrote the longer version of this on DevToolLab, with the full pricing breakdown: Best AI Code Execution Sandboxes in 2026. Also buried in there, and worth knowing before you compare anything: one of the four platforms every roundup still labels open source stopped being open source in June 2026.

AI code execution sandboxes compared

Four things a real sandbox isolates

Cover three of these and you do not have a sandbox, you have a speed bump.

Filesystem. Visibility limited to its own working directory. Not your home folder, and specifically not the credential files parked there.

Network. Egress denied by default, or allowlisted. Code that can read secrets and make outbound requests is an exfiltration pipeline with extra ceremony.

Process and kernel. A shared kernel means one container escape equals a host compromise. This is exactly why the serious platforms run microVMs instead of plain containers.

Resources. Caps on CPU, memory and wall-clock time, so an infinite loop costs cents rather than a node.

Measure your own exposure before shopping

Worth running before you conclude isolation is somebody else's problem. It counts exposure, never prints a secret value, and never transmits anything.

"""What agent-generated code can reach when you just run it."""
import os
import socket
import tempfile
from pathlib import Path

SECRET_HINTS = ("KEY", "TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "API")

# 1. Environment: this is where API keys live.
env_total = len(os.environ)
env_secretish = [k for k in os.environ if any(h in k.upper() for h in SECRET_HINTS)]

# 2. Filesystem: can it see the paths that hold long-lived credentials?
home = Path.home()
sensitive = {
    "~/.ssh": home / ".ssh",
    "~/.aws": home / ".aws",
    "~/.config": home / ".config",
    "~/.gitconfig": home / ".gitconfig",
}
readable = {}
for label, p in sensitive.items():
    try:
        if p.is_dir():
            readable[label] = f"{len(list(p.iterdir()))} entries"
        elif p.exists():
            readable[label] = f"{p.stat().st_size} bytes"
        else:
            readable[label] = "absent"
    except PermissionError:
        readable[label] = "permission denied"

# 3. Network: can it reach the internet to send what it found?
try:
    s = socket.create_connection(("1.1.1.1", 443), timeout=4)
    s.close()
    net = "reachable"
except OSError as e:
    net = f"blocked ({type(e).__name__})"

# 4. Write access outside its own directory.
try:
    p = Path(tempfile.gettempdir()) / "agent_was_here.txt"
    p.write_text("x")
    p.unlink()
    write = "yes"
except OSError:
    write = "no"

print(f"env vars visible          : {env_total}")
print(f"  ...that look like creds : {len(env_secretish)}  {sorted(env_secretish)[:4]}")
print("credential paths reachable:")
for k, v in readable.items():
    print(f"  {k:<14} {v}")
print(f"outbound network          : {net}")
print(f"write outside cwd         : {write}")
Enter fullscreen mode Exit fullscreen mode

Output on my laptop, from a shell with decent hygiene:

env vars visible          : 60
  ...that look like creds : 0  []
credential paths reachable:
  ~/.ssh         10 entries
  ~/.aws         2 entries
  ~/.config      20 entries
  ~/.gitconfig   109 bytes
outbound network          : reachable
write outside cwd         : yes
Enter fullscreen mode Exit fullscreen mode

Note the zero credential-shaped env vars. That is both the good news and proof the script is not stacked in my favor. The exposure is entirely on the filesystem side: ten readable entries in ~/.ssh, two in ~/.aws, and an open network to move them across. Now add the guard everyone reaches for first:

completed in 78ms under a 5000ms timeout
Enter fullscreen mode Exit fullscreen mode

Daytona is not open source any more

Daytona shows up in every list in this category, almost always described as the open-source pick, and 72,000 GitHub stars back that reputation. Open the repository right now and the root holds a README and an images folder. The source is gone.

The daytonaio/daytona GitHub repository showing 72k stars, a root with only a README and assets folder, and a notice that the repository is no longer maintained with core development moved to a private codebase as of June 2026

The banner leaves no room for interpretation: no longer maintained, core development moved to a private codebase as of June 2026, no further updates, fixes or releases. What was public stays AGPL-3.0, frozen at tag v0.190.0. Scroll down that same README and it still describes "our open-source platform," untouched since the pivot.

None of which makes the product bad. OCI-compatible sandboxes with a dedicated kernel, Python, TypeScript and JavaScript support, and a claimed sub-90ms cold start. One caveat on that figure: the 90ms everyone quotes originates in Daytona's own README, not an independent benchmark. Budget for it as the proprietary service it is now, and do not build a plan that depends on forking it.

E2B

E2B is Apache 2.0, roughly 13,400 stars, and e2b-dev/E2B is actively committed to. It was designed for agent code execution from the start rather than retrofitted into it. Compute is $0.0504 per vCPU-hour plus $0.0162 per GiB-hour, storage free. The Hobby tier hands you a one-time $100 credit, caps sessions at one hour and allows 20 concurrent sandboxes. Pro runs $150/mo plus usage, lifting sessions to 24 hours and concurrency to 100, expandable to 1,100. No GPU option.

E2B pricing page showing the free Hobby tier, Pro at $150 per month, and Ultimate Enterprise, all marked plus usage

Modal, and the two numbers people misquote

Modal is the pick the moment a GPU is involved: H100 SXM5 at $3.95/hr, A100 80GB at $2.50/hr, and no quota approval process standing in the way. It also bills nothing while idle, which is a real advantage for bursty agent workloads.

Two billing details are easy to get wrong. First, Sandbox pricing is not Modal's general compute pricing: Sandboxes are $0.142 per core-hour versus $0.047 for standard compute, roughly triple the rate usually cited in comparisons. Second, Modal bills per physical core, which its own pricing page defines as two vCPU. Normalize that and a Sandbox core is about $0.071 per vCPU-hour, which lands Modal next to Cloudflare rather than at the expensive end. Starter is free with $30 credit, Team is $250/mo with $100.

Modal pricing showing per-second GPU rates and a CPU line defining a physical core as 2 vCPU equivalent

Cloudflare and Vercel

Cloudflare Sandboxes run the container at the edge next to the user, which is the correct shape when per-call latency is what you are optimizing. Active CPU is $0.072 per vCPU-hour. The catch is that this is one meter of several: Workers requests and Durable Objects bill separately, on top of a $5/mo Workers Paid plan that is a prerequisite for any of it.

Vercel Sandbox is the ecosystem bet, and it makes sense mostly if you are already deployed there. Active CPU is $0.128/hr, creations $0.60 per million, network $0.15/GB, snapshots $0.08 per GB-month. The line that surprises people is memory at $0.0212 per provisioned GB-hour, billed on what you provisioned for as long as the sandbox exists, not on what it consumed. A forgotten idle sandbox is still charging you for memory.

Normalized pricing

Platform License vCPU-hour Idle billing GPU
E2B Apache 2.0 $0.0504 Yes, while alive No
Cloudflare Sandboxes Commercial $0.072 active CPU Plus Workers and DO No
Vercel Sandbox Commercial $0.128 active CPU Memory billed provisioned No
Modal Commercial $0.071 (billed $0.142 per 2-vCPU core) No H100, A100
Daytona Closed since June 2026 Quote Quote Yes

On a per-vCPU-hour basis E2B is cheapest at $0.0504, Modal and Cloudflare cluster together at $0.071 and $0.072, and Vercel is dearest at $0.128. Mind the units if you verify this yourself: Modal's $0.142 headline covers two vCPUs, so comparing it straight across doubles the real figure.

The ranking reshuffles under load anyway. Modal billing zero while idle beats a cheaper hourly rate for spiky work. E2B's cheap compute sits behind a $150/mo floor the moment you need sessions past an hour. Cloudflare reads as mid-range right up until you total its other three meters.

Picking one

  • Short bursts of untrusted code, no GPU: E2B. Stay on Hobby until the one-hour session cap or the 20-sandbox concurrency limit actually gets in your way.
  • Anything touching a model or a GPU: Modal, budgeted at the Sandbox rate rather than the compute rate.
  • Latency-sensitive execution near users: Cloudflare, with all four billing dimensions in your spreadsheet.
  • Already on Vercel and want one invoice: Vercel Sandbox, with a hard ceiling on sandbox lifetime because provisioned memory bills the entire time.
  • Long-lived workspaces an agent lives inside: Daytona, priced as the proprietary product it now is.

Six steps to wire one up without surprises

  1. Run the script above on your own machine first. If ~/.ssh and ~/.aws come back readable, your business case is written.
  2. Choose the base image on purpose. These platforms are OCI-compatible, so the sandbox is exactly as minimal as the image you hand it. A Dockerfile generator will scaffold one, and a dockerignore generator keeps .env, .ssh and .aws from being copied in during the build, which is the most common way a supposedly sandboxed image ships its own secrets.
  3. Test the isolation flags locally before paying for them. --network none and --read-only cost nothing to try on your laptop, and a docker run command builder assembles them so you can watch the script above fail the way it should.
  4. Audit what you inject as environment variables. Anything you pass in, the code inside reads. Run the file through a dotenv linter and pass only the keys that sandbox genuinely requires.
  5. Set a lifetime, not just a timeout. A timeout bounds one call; a sandbox left running bills until something kills it, and on Vercel it bills provisioned memory the whole while.
  6. Deny egress by default. Allowlist the handful of hosts the task needs. This is the one control that downgrades a credential leak to a non-event.

The original article goes further on each platform's billing dimensions than I have room for here.

Wrapping up

Keep the measurement, if nothing else: unsandboxed agent code reached credential directories and open network in 78 milliseconds, and the timeout most people rely on is 64 times too slow to be relevant. Once you are executing code a model wrote, isolation stops being a nice-to-have.

On platform choice, honestly: E2B is the cheapest per vCPU-hour and the last genuinely open-source option here. Modal wins on GPUs and idle billing while charging roughly triple its advertised compute rate for Sandboxes specifically. Cloudflare wins on latency across four meters. Vercel is the priciest per hour and the easiest if you already live there. Daytona is a solid product that is no longer open source, whatever the roundups and its own README still claim.

Prices, licenses and repository status move fast in this category. Check each vendor's page on the day you decide.

References

Top comments (0)