The best AI agent sandboxes.

An agent sandbox runs untrusted code separately. It usually exposes commands and files. Many products also expose network controls. Some preserve state across sessions.

A development sandbox behaves like a computer. A function sandbox behaves like isolated execution. A browser session isolates web interaction. These categories overlap only partly.

Your model remains outside some sandboxes. The agent loop may run elsewhere. That split affects secrets and networking. It also affects observability.

Start with the dangerous capability. Code execution needs process containment. Browser interaction needs browser isolation. Desktop control needs another boundary. Do not merge these silently.

General agent execution established eligibility. Each vendor needed command and file controls. Clear isolation documentation supported buyer confidence. Lifecycle controls shaped production usefulness.

Persistence received separate review. Resource configuration mattered for expensive workloads. Deployment fit mattered for existing cloud stacks. Pricing clarity completed the ranking.

Published speed claims received no ranking credit. Published scale claims established available product paths only. We did not infer security from marketing. Independent testing remains necessary.

The ranking favors broad agent execution. Specialist workloads may change the order. Each entry includes one honest limitation. Read it before evaluating price.

Vendor documentation establishes product shape. It does not prove containment strength. Security review must follow architecture review.

E2B offers a compact developer entry point. Its SDK creates an isolated cloud environment. Agents can run commands and manage files. Internet access is also documented.

E2B now documents pause and resume. Default pausing preserves filesystem state, memory, and processes. Paused sandboxes stop compute billing. They require explicit deletion later.

Daytona presents a broader computer model. Containers cover normal code execution. VM classes add dedicated operating systems. GPU sandboxes cover accelerated workloads. Daytona also offers macOS sandboxes for desktop automation.

Daytona lifecycle depends on runtime class. Container stop retains files, not memory. VM pause preserves files and memory. GPU stop deletes that sandbox.

Choose E2B for balanced persistence. Choose Daytona for broader runtime classes. Verify class differences before committing.

Modal places sandboxes inside broader compute infrastructure. Builders configure CPU and memory. GPU-backed sandboxes support accelerated tasks. Billing follows requested or actual resources.

Modal supports filesystem snapshots across fresh sandboxes. Filesystem snapshots expire after 30 days by default. Memory snapshots remain an alpha feature. They expire after 7 days. Python remains its primary application language.

Runloop focuses on software-engineering agents. Devboxes act like virtual developer workstations. Blueprints define reusable environments. Suspend and resume keep work without compute charges.

Cloudflare Sandboxes fit Workers applications. Containers run Linux images in microVMs. Dynamic Workers run code against methods you pass. Your Worker keeps credentials and network policy.

Sandbox SDK 0.x now serves existing applications. New projects start from the current Sandboxes docs. Container scheduling remains in public beta.

The broadest sandbox is rarely automatically best. Extra capabilities create extra review work. Persistent state also creates retention duties. Network access changes the threat model.

Use the matrix before vendor trials. Choose one primary workload. Add secondary capabilities only when required. Keep the final boundary explainable.

Isolation separates a sandbox from other workloads. It does not limit code inside that sandbox. That code can read files, variables, and arguments. Cloudflare's sandbox security guide states this directly.

Several vendors keep credentials outside instead. E2B secrets inject values at its egress proxy. Runloop gateways keep real credentials off devboxes. Cloudflare Workers add tokens after requests leave.

Every allowed destination is also an exit. Allow only hosts the task needs. Treat sandbox output like untrusted input.

E2B bills running CPU and RAM by second. Paused sandboxes stop compute billing. Included disk depends on the plan.

Daytona charges reserved sandbox resources. Billing tracks CPU, memory, and disk usage. Lifecycle state affects which resources remain charged. The dashboard exposes per-sandbox usage.

Modal bills by second. Charges use requested or actual resource usage. The higher value wins. GPU sandboxes face preemption.

Runloop charges subscription and usage separately. CPU, memory, builds, and storage use distinct meters. Suspended devboxes stop compute charges. Storage charges continue.

Cloudflare Containers need the $5 Workers Paid plan. Running time bills in 10-millisecond increments. Memory and disk follow the provisioned instance. Workers and Durable Objects bill separately.

Legba publishes a browser skill and hosted MCP tools. It documents routing and isolated browser sessions. A person can take over through handoff.

The published skill documents no shell or filesystem contract. Therefore, this ranking excludes Legba.

Some architectures still need both boundaries. A code sandbox runs agent tools. A browser service handles web interaction. Legba fits that browser boundary.

E2B ranks first for balanced general use. Daytona follows for broader runtime classes. Modal wins flexible compute. Your risk model decides.