Run untrusted code safely: an AI agent in a disposable sandbox

The agent writes and runs a script, tries to reach the internet, and reports that the call fails inside a microVM that vanishes afterwards.

Shell
Budget cap

Watch a real run

A real run on Oct 7, 2026, replayed. Model: openai/gpt-6-luna.

Succeededrun_de9af30ebaaa50ab76819bb536239c61$0.00353 of $0.04

0.00Queuedbudget $0.04 reserved
2.42MicroVMmicroVM ready
2.47MicroVMworker started · shell on · web off
5.25Shell$ pwd; whoami
5.25Shell$ command -v curl && curl -sS -m 8 https://example.com
10.33Shell$ printf '%s\n' '#!/usr/bin/env python3' 'primes = []' 'n = 2' 'while len(primes) < 15:' ' if all(…
10.33Shell$ printf 'sandbox proof\n' > /tmp/proof.txt && ls -l /tmp/proof.txt
15.83MicroVMmicroVM destroyed
15.84
Succeeded3 model calls, 5,214 tokens
Recorded output (English)
1. Prime script output: 2 3 5 7 11 13 17 19 23 29 31 37 41 43 47
2. whoami: worker; pwd: /tmp/ephemeral-run-s2TPIy/scratch
3. curl error: curl: (6) Could not resolve host: example.com
4. /tmp/proof.txt created; ls -l: -rw-r--r-- 1 worker worker 14 Oct 7 15:02 /tmp/proof.txt
The network call did not succeed.
16.24Worker destroyed$0.00353 charged, $0.03647 released

Model $0.00033 · Web $0.00 · Compute $0.0032

Run it yourself

Open the sample in the playground with the whole request filled in. It runs on your own account, within the budget shown, against the same read-only sample systems.

Budget for this sample: $0.04

Open in the playground Sign up to run it Sign in

How it works

Web access is off and the shell is on, so the agent can run code but cannot send anything out. The prompt asks it to try a network call and report the exact failure, which makes the isolation visible in the timeline. Nothing it writes survives the run.

What the agent can and cannot do

The permissions are part of the request. Anything not listed here is not available to the run.

Setting	Allowed
Connections	None
Web	Off
Shell	On, inside the sealed machine
Files	None
Zero data retention	Off: the record is kept for 30 days
Budget	$0.04, a hard cap
Timeout	120 seconds

Credentials never enter the machine: a broker adds them to each call and enforces the methods above.

The code

This is the exact request the sample sends. Set EPHEMERAL_API_KEY to a member key of your organization.

curl -X POST $EPHEMERAL_URL/v1/runs \
  -H "Authorization: Bearer $EPHEMERAL_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d @request.json

Full request body request.json

The same body, with the files inline.

request.json

{
  "prompt": "This is a sandbox test. Do these steps with the shell and report the real output, never what you expect. 1) Write a small script that prints the first 15 prime numbers, run it and show the output. 2) Run `whoami` and `pwd`. 3) Try to reach the internet with `curl -sS -m 8 https://example.com` (and, if curl is missing, python3 with urllib) and report the exact error. 4) Write a file named /tmp/proof.txt and list it. Reply in Markdown, at most 120 words: one line per step with the result, then one sentence saying whether the network call succeeded.",
  "web": false,
  "shell": true,
  "timeout_seconds": 120,
  "max_cost_micros": 40000
}