The best AI agent sandboxes.

An agent sandbox runs untrusted code separately. It usually exposes commands and files. Many products also expose network controls. Some preserve state across sessions.

A development sandbox behaves like a computer. A function sandbox behaves like isolated execution. A browser session isolates web interaction. These categories overlap only partly.

Your model remains outside some sandboxes. The agent loop may run elsewhere. That split affects secrets and networking. It also affects observability.

Start with the dangerous capability. Code execution needs process containment. Browser interaction needs browser isolation. Desktop control needs another boundary. Do not merge these silently.

General agent execution established eligibility. Each vendor needed command and file controls. Clear isolation documentation supported buyer confidence. Lifecycle controls shaped production usefulness.

Persistence received separate review. Resource configuration mattered for expensive workloads. Deployment fit mattered for existing cloud stacks. Pricing clarity completed the ranking.

Published speed claims received no ranking credit. Published scale claims established available product paths only. We did not infer security from marketing. Independent testing remains necessary.

The ranking favors broad agent execution. Specialist workloads may change the order. Each entry includes one honest limitation. Read it before evaluating price.

Vendor documentation establishes product shape. It does not prove containment strength. Security review must follow architecture review.

E2B offers a compact developer entry point. Its SDK creates an isolated cloud environment. Agents can run commands and manage files. Internet access is also documented.

E2B now documents pause and resume. Default pausing preserves filesystem state, memory, and processes. Paused sandboxes stop compute billing. They require explicit deletion later.

Daytona presents a broader computer model. Containers cover normal code execution. VM classes add dedicated operating systems. GPU sandboxes cover accelerated workloads.

Daytona lifecycle depends on runtime class. Container stop retains files, not memory. VM pause preserves files and memory. GPU stop deletes that sandbox.

Choose E2B for balanced persistence. Choose Daytona for broader runtime classes. Verify class differences before committing.

Modal places sandboxes inside broader compute infrastructure. Builders configure CPU and memory. GPU-backed sandboxes support accelerated tasks. Billing follows requested or actual resources.

Modal supports filesystem snapshots across fresh sandboxes. Memory snapshots remain an alpha feature. Their retention rules differ. Python remains its primary application language.

Runloop focuses on software-engineering agents. Devboxes act like virtual developer workstations. Blueprints define reusable environments. Suspend and resume preserve disk state.

Cloudflare Sandbox SDK fits Workers applications. Durable Objects identify sandbox instances. Containers run commands and manage files. Services can be exposed through controlled URLs.

Cloudflare currently has two API tracks. Stable supports existing deployments. The preview targets the upcoming major release. New projects need deliberate version selection.

The broadest sandbox is rarely automatically best. Extra capabilities create extra review work. Persistent state also creates retention duties. Network access changes the threat model.

Use the matrix before vendor trials. Choose one primary workload. Add secondary capabilities only when required. Keep the final boundary explainable.

E2B bills running CPU and RAM by second. Paused sandboxes stop compute billing. Included disk depends on the plan.

Daytona charges reserved sandbox resources. Billing tracks CPU, memory, and disk usage. Lifecycle state affects which resources remain charged. The dashboard exposes per-sandbox usage.

Modal bills by second. Charges use requested or actual resource usage. The higher value wins. GPU sandboxes face preemption.

Runloop charges subscription and usage separately. CPU, memory, builds, and storage use distinct meters. Suspended devboxes stop compute charges. Storage charges continue.

Cloudflare Sandbox SDK requires Workers Paid. Container usage adds separate charges. Durable Objects add related charges. Model one complete application stack.

Legba publishes a ready browser skill. Its cited page documents routing and isolation. The agent stack owns permissions and logs.

That cited page omits general sandbox controls. It documents no shell or filesystem contract. Therefore, this ranking excludes Legba.

Some architectures still need both boundaries. A code sandbox runs agent tools. A browser service handles web interaction. Legba may serve the browser boundary.

E2B ranks first for balanced general use. Daytona follows for broader runtime classes. Modal wins flexible compute. Your risk model decides.