Why Agent Sandboxing Became Urgent

OpenClaw helped popularize local terminal Agents in early 2026, pushing users to grant AI-driven programs access to files, browsers, email, terminals and account permissions. That also exposed a practical security problem. Meta Superintelligence Labs alignment lead Summer Yue said her “little lobster” deleted and archived hundreds of personal emails and ignored stop instructions.

For enterprises, the issue is broader than model hallucination. An Agent can plan, call tools, access networks and act with user-like privileges. If such a system runs directly on a laptop or production server, its unpredictable behavior needs a hard boundary. This is why isolated, recoverable sandboxes are moving from a developer convenience to a core Agent infrastructure layer.

Cube’s Serverless Origin

Tencent Cloud open-sourced Cube Sandbox in April 2026 as an execution foundation for AI Agents. Its roots go back to around 2023, before the current Agent boom, when the team was building infrastructure for Serverless workloads: create an environment quickly when a function is invoked, and release resources immediately after execution.

Cube uses a RustVMM plus KVM architecture and chose Cloud Hypervisor rather than the more common Firecracker route. According to Tencent Cloud engineer Jinfeng, the internal environment required broader hardware capabilities such as device hot-plugging and hardware passthrough. The team then reduced overhead on top of a more complete VMM.

Key capabilities include:

• Fast startup: snapshot-based restore with cold start under 60 ms;
• High concurrency: compute nodes handle sandbox creation independently, allowing cluster capacity to scale with nodes;
• High density: shared read-only kernels, root file systems and copy-on-write mechanisms allow a single node to host thousands of lightweight instances.

These Serverless-oriented capabilities later proved relevant to Agent workloads, especially frequent tool execution and bursty scaling.

From Speed to Control

Jinfeng describes three infrastructure needs for Agents. First, tool execution requires strong isolation and high concurrency. Second, long-running Agent Harness workloads need state saving, recovery, cloning and rollback. Third, services accessed by Agents may become part of training or inference loops, creating demand for fast start-stop cycles and branch exploration.

Traditional platforms only solve part of the problem. Virtual machines provide stronger isolation but may take 5 to 10 seconds from API request to actual availability. Docker containers start quickly and use resources efficiently, but share the host kernel. Serverless functions are well suited to short, stateless tasks, but not to stateful Agent runtimes.

Cube’s newer releases reflect this shift. v0.3.0 added snapshot, clone and rollback. v0.4.0 added egress governance, credential hosting and network observability/auditing. v0.5.0 introduced AutoPause and AutoResume, native Arm support and cluster deployment examples. The goal is not to reduce Agent flexibility, but to contain the parts that cannot be predicted.

The Production Barrier

For enterprises, a sandbox must be deployable, observable and maintainable inside existing infrastructure. Cube initially ran mainly on physical machines, which helped KVM performance but raised adoption costs. After open-sourcing the project, the team began adding support for running Cube inside cloud virtual machines. The latest v0.6.0 release adds Kubernetes support, continuing the effort to lower deployment barriers.

That is why Cube is positioned as more than a temporary “code execution” sandbox. Agent runtimes need fast startup, state persistence, environment cloning, rollback after mistakes and strong isolation under high concurrency. Only when those capabilities fit into enterprise infrastructure can a sandbox move from a developer tool to a production foundation.

What Open Source Signals

Cube also entered the overseas Agent ecosystem after being open-sourced. The original report notes that in July, OpenClaw founder Peter Steinberger submitted and merged a PR for Crabbox, integrating Cube into its provider system alongside sandbox services such as E2B and Modal.

This suggests that Agent execution environments have become a shared infrastructure concern for developers and cloud vendors. The broader trend is clear: Agent infrastructure will not simply replace VMs, containers or Serverless. It is likely to form a new execution layer above them. The systems that combine isolation, state management, resource efficiency and enterprise-grade operations are more likely to become the foundation for production Agent workloads.