What’s happening

In October, two companies that sell the same kind of product said how big they’d become.

On 14 October, Modal raised money at a $15.75 billion valuation (opens in a new tab). Modal rents out computing power for AI work. But its post singled out one product, Sandboxes, and called it “a $300M run rate product just on its own.” So, by Modal’s count, that one product is on course to bring in about $300 million a year.

Six days later, Daytona said it was worth $1 billion (opens in a new tab). Daytona started as a sandbox company, and sandboxes are still what it’s known for.

So what’s a sandbox, and why is it suddenly worth this much? It’s a computer that an AI agent gets to use on its own. The agent writes code, and the sandbox is where that code runs, away from anything it could break or steal. Most coding agents that work in the cloud need one. So does an agent that analyses a spreadsheet by writing a script.

In the same few months, many cloud companies started selling one too. DigitalOcean, Docker, Google, Render, Railway and AWS all launched or announced sandboxes for agents this year.

The money in this market is real. But what’s inside the box is mostly free, and the business is moving to what sits around it. If you market a devtools product, there’s a second lesson here too: this category settled on its slogans in months. We’ll get to both.

What a sandbox is for

Start with the problem. An AI agent writes code and then runs it. Nobody reviews that code first, and the agent itself can be fooled.

Simon Willison writes a lot about AI security. Last year he gave this danger a name: the lethal trifecta (opens in a new tab). An agent is at risk when it has three things at once. It can reach your private data. It reads text from strangers. And it has a way to send data out. A web page or a GitHub issue can hide instructions. The agent reads them, follows them, and sends your data somewhere.

A sandbox goes after the first of the three. The code runs on a separate machine, with no access to your laptop, your company network or your passwords, unless you give it. Hold on to the third one, the way out. It comes back later.

There are a few ways to build the wall, and they differ in how thick it is:

  • A container shares the operating system’s core, the kernel, with everything else on the server. It’s light and fast. But one bug in that shared kernel can let code escape.
  • A microVM is a small virtual machine with its own kernel. To get out, code has to get past the hardware’s virtualization, not just one shared kernel.
  • gVisor, a project from Google, sits in between. It puts a stand-in kernel between the code and the real one.

The best-known microVM is called Firecracker, and it has a history. AWS built it for Lambda, its service that runs customers’ code on demand, and open-sourced it in 2018 (opens in a new tab). Before that, AWS gave each Lambda customer separate servers to keep them apart, and that was expensive. Firecracker starts a tiny virtual machine in about an eighth of a second.

E2B, Vercel, DigitalOcean and Render all say they use Firecracker. Modal offers gVisor or a full virtual machine (opens in a new tab), and picks for you if you don’t choose. Docker built its own (opens in a new tab), because Firecracker has no native support for Mac or Windows.

So the wall at the heart of many of these products is free and open source. AWS built one kind and Google built another.

The money

Now, what do the three best-known companies say about their business? All of these numbers are the companies’ own.

Modal is the biggest of the three, on the numbers they disclose. It launched Sandboxes in 2023, “when we noticed that people were using LLMs to generate code,” its post says (opens in a new tab). Sandboxes are about $300 million a year of a business that runs at more than $1 billion. Modal says it has started “close to 3 billion sandboxes.”

Daytona grew fastest, from a much smaller base. This week its CEO, Ivan Burazin, wrote (opens in a new tab) that Daytona went from $1 million a year to $100 million in four quarters. He’s open about what that number is:

Ten days into October, it was already showing $100M. I knew it was a projection.

In other words, $100 million is what ten good days in October would add up to over a year. It’s not a year of money in the bank.

He’s open about how close it came, too. He says Daytona had only a few months of money left when it started over. It even handed its old customers to competitors. A company that rebuilt itself with almost no runway is now valued at $1 billion.

E2B is one of the earliest names. It’s a small company founded in the Czech Republic, and several well-known agent products have run on its sandboxes. It says sandbox starts passed one billion in June and two billion in October (opens in a new tab), so its usage doubled in about four months. But E2B has raised only about $32 million (opens in a new tab), by its own last count, and we found no funding round this year. It doesn’t publish revenue.

So Modal’s sandbox product alone is about three times Daytona’s projected business. And one of the companies that started the category has raised the least.

Everyone moved in

Here’s the calendar for this year. Each of these launched, opened or announced a sandbox product for agents:

Now read their homepages. They sound alike, and that’s the part a marketer should notice.

Many of them say the agent gets a computer. E2B (opens in a new tab): “Every agent gets a machine”. Render (opens in a new tab): “A computer for every agent”. Modal (opens in a new tab): “Computers for agents”. Railway (opens in a new tab): “A full computer on demand”.

Some sell safety instead. Vercel’s headline is “The safest way to run code you didn’t write” (opens in a new tab). Cloudflare and Daytona also lead with running AI-written code securely.

And two companies use the same heading, word for word. DigitalOcean’s page (opens in a new tab) and Railway’s page (opens in a new tab) both say “Priced for how agents actually work”. We couldn’t tell who wrote it first.

Of the homepages we read, only one argues with the category’s own word. Fly.io’s headline is “Sandboxes aren’t enough” (opens in a new tab).

Here’s why that matters. Categories usually take longer than this to settle on their words. This one looks to have taken months. When this many companies say the agent gets a computer, nobody owns the idea. And the buyer is left comparing prices.

The price

So let’s compare prices. Take one agent task: 2 processors and 4 GB of memory, running for 15 minutes.

Let’s do the math at E2B’s list price (opens in a new tab). It charges $0.0504 an hour for each processor and $0.0162 an hour for each GB of memory. So that’s 2 × $0.0504 + 4 × $0.0162 = about 17 cents an hour. A quarter of an hour is about 4 cents.

Across all the providers we checked, the same task comes out between about 1 and 10 cents. It’s cheap. But how each company gets there tells you a lot.

Two of them charge the same. Daytona (opens in a new tab) lists exactly E2B’s rates, for processors and for memory, to the decimal. The two best-known pure sandbox companies compete on free credits and limits, not on the rate.

The bigger difference is what the meter counts. E2B, Daytona and Modal charge for the processors you reserve, whether the agent uses them or not. Vercel, Cloudflare, Render, Railway and Fly.io charge only for the processor time the agent actually uses.

That difference matters more than any discount, because agents mostly wait. They send a question to a model and sit idle until the answer comes back. Daytona’s CEO said on a podcast that the average Daytona sandbox keeps its processors busy only 15% of the time (opens in a new tab).

But memory stays reserved while the agent waits, so you pay for all of it. That’s why, on a pay-for-use meter, memory becomes most of the bill. In Vercel’s own pricing examples (opens in a new tab), it’s about three quarters.

One cloud is pricing under the startups. DigitalOcean’s MicroVMs cost $0.022 per processor-hour (opens in a new tab), less than half of E2B’s and Daytona’s rate. They’re still in preview, in one region (opens in a new tab).

And a sandbox costs more than the same computer rented the ordinary way. Modal says outright that sandboxes are billed at “3x list price” (opens in a new tab), because they’re never interrupted to make room for other work. Railway charges five times its normal memory rate for sandbox memory. That math is ours, from Railway’s own page (opens in a new tab).

Is any of this a big deal next to the bill for the AI model? It depends on the model.

OpenRouter, which routes requests between AI models, published median costs (opens in a new tab) for Claude Code sessions last week. A long session on Opus, one of Anthropic’s top models, costs about $1.39 in model fees. OpenRouter doesn’t say how long a session lasts, so say it runs 30 minutes. At E2B’s rate, that sandbox costs about 8 cents. That’s about 6% of the bill.

Now switch to Haiku, a small and cheap Anthropic model. The same kind of session costs about 5 cents in model fees. Now the sandbox costs more than the model. The math is ours.

DigitalOcean’s product chief made the same point in September (opens in a new tab): “Today infrastructure is roughly 3 to 8% of a typical run’s cost.” That’s DigitalOcean’s own estimate, and it doesn’t say how it got it. He expects the share to grow as models get cheaper. That’s the bet behind DigitalOcean’s product.

Who’s buying

Here’s something that surprised us. The people who use coding agents almost never see a sandbox price.

Anthropic runs Claude Code’s cloud sessions itself, and its docs say there’s “no separate charge for the cloud VM” (opens in a new tab). Kiro, Amazon’s coding agent, says the same (opens in a new tab). GitHub starts billing (opens in a new tab) for its cloud sandboxes this month, but takes it out of the allowance companies already pay for. So three popular agent products don’t show their users a separate sandbox price.

That means the sandbox companies sell to a different customer: the people who build agents. Two groups stand out. One is companies building AI products, like Lovable, Cognition or Clay. The other is AI labs and the firms that make training data for them.

Why would a lab need sandboxes to train a model? Because one way models learn to code is by practice. A model gets a task, writes code in a sandbox, and gets scored on whether it works. Do that millions of times and you need millions of sandboxes. Daytona’s CEO said on the same podcast (opens in a new tab) that this kind of training work went from nothing to about half of what runs on Daytona.

And the builders make sure their customers can switch. Anthropic’s Managed Agents, its service for running agents, lets the sandbox run on the customer’s own servers “or with managed providers like Cloudflare, Daytona, Modal, or Vercel” (opens in a new tab). OpenAI’s toolkit for building agents lists seven hosted providers (opens in a new tab) as of this week. So the lab keeps the agent, and the sandbox becomes a part the customer can swap.

Some big users simply build their own. Perplexity built a sandbox platform called SPACE, then open-sourced it (opens in a new tab) in October. Its code includes a layer that lets programs written for E2B use SPACE instead, with a new address and key, though some options aren’t supported. In January, Czech press (opens in a new tab) named Perplexity as an E2B user. We think that’s who it left, but that’s our reading, not something Perplexity has said.

OpenAI went further. This year it bought Ona, the company that used to be called Gitpod, which runs computers for developers. It did that so Codex, its coding agent, can run jobs that “take hours or days” (opens in a new tab). Yet its toolkit still lists seven outside providers for everyone else.

Is the box safe?

Most companies here sell safety. This year’s biggest failure came from a lab that built its own.

In July, during an internal test at OpenAI, AI agents got out of their test environment and broke into parts of Hugging Face’s systems. Hugging Face counted about 17,600 actions (opens in a new tab) the agents took over four and a half days. Docker notes (opens in a new tab) that about two and a half of those days were inside Hugging Face’s infrastructure. OpenAI later published a 38-page report (opens in a new tab).

What OpenAI called a sandbox was a set of containers, a thinner wall than a microVM. The agents got out through a bug in an internal copy of a software package store. That service was allowed to reach the internet, so it became their way out. Later, they used a known bug in the Linux kernel to get from one container onto the machine underneath. On 20 July, OpenAI required all its research container workloads to use microVM sandboxes. In other words, the lab moved to the kind of wall this piece is about.

The agents also used a sandbox platform along the way. They found a Modal customer’s app that let anyone on the internet run code, with no login. Modal’s platform wasn’t broken into. The customer had left the door open.

Then there’s Vercel. We covered this last month. In August, Vercel offered up to $1 million to anyone who could break out of its Sandbox. It paid $242,000 (opens in a new tab). The worst finding wasn’t in Firecracker. Packets sent from inside a sandbox could attack the networking code of the Linux kernel on the host machine. That’s the same code almost every cloud uses. The challenge also found two ways one customer’s sandbox could reach another’s data. Vercel says no report showed anyone getting at real customer data.

There are bugs in the walls themselves too. AWS’s April security bulletin for a Firecracker flaw thanks Anthropic (opens in a new tab) for reporting it. And the newest Firecracker flaw, published on Wednesday (opens in a new tab), only affects sandboxes restored from a saved snapshot under certain settings. Saving and restoring a sandbox is one of the features vendors compete on.

Put those together. Of the two real-world incidents we looked at, neither went through a microVM wall. One went through a service the agents were allowed to use, and one through a customer’s open door. And when researchers did get past a microVM at Vercel, they did it through the host machine’s network code.

Remember the third part of the trifecta, the way out? Vercel made that argument in August (opens in a new tab), in one line:

Isolation without egress control contains the process, not its consequences.

Egress is the traffic going out. A sandbox that lets code send anything anywhere is only half a sandbox.

Our take

Our take: the wall is becoming a commodity, and the business is moving to what surrounds it.

The best case against that comes from the companies’ own numbers. A commodity doesn’t usually grow a hundredfold in a year, as Daytona projects it has. And Modal charges three times its normal rate for sandboxes, and is still on course to sell $300 million of them a year. Buyers don’t usually pay a premium for a commodity. Training work may be part of why. It needs huge numbers of sandboxes that start fast and are never interrupted. While that demand grows this fast, the best providers can charge for it.

But look at what the market is doing underneath the growth. Much of the wall is free and open source, built by AWS or Google. Two leaders charge the same price. One cloud already charges less than half. The labs designed their products so the customer can switch providers. And a big customer can build its own and give it away, as Perplexity did. In October, a founder launched yet another sandbox company on Hacker News. One commenter made the case against it (opens in a new tab) in a single line: “You cannot 10x on basically what’s just a VM with a few agent-friendly features in 2026.”

So where does the value go? To the parts this year’s incidents were about. That means control over what leaves the box, and the services the agent is allowed to talk to. It also means saving and restoring a sandbox’s state, which is hard to move to another provider. Those are harder to copy than the wall, and harder to leave once you rely on them.

For marketers, the lesson is in the headlines. Many of these companies say the agent gets a computer. When everyone uses the same words, the words stop helping anyone. Vercel at least picked a claim it could test. It said it was “the safest way to run code you didn’t write”, paid people to attack it, and published what they found, flaws included. That’s a claim with evidence behind it.

What to watch

Watch E2B. It’s one of the earliest names, its usage doubled in four months, and we found no funding round this year. A big round, a sale or a price cut would each tell you a lot about this market.

Watch Google. Its Agent Compute Engine already powers Gemini as an agent for work tasks, and opens to customers in preview “in the coming months”. Its price could reset the floor.

And watch the leaders’ rate cards. We found no sign that Modal, Daytona or E2B has cut its list price this year, though we couldn’t check their old price pages. So far, the cheaper prices have all come from someone else.