Run untrusted code in a disposable microVM
An agent writes and runs code you do not trust, or processes files you do not trust, without any of it touching your own machines. Ephemeral starts a fresh microVM for every run with the shell on and the network off, streams every command to you, reserves the budget before the run starts and destroys the machine, and everything the agent wrote, when it ends.
What the run is allowed
Everything a run can touch is listed in its request. This is the request of the sample Run untrusted code safely: an AI agent in a disposable sandbox.
| Files | None |
|---|---|
| Connections | None |
| Web access | Off |
| Shell | On, in the sealed microVM |
| Budget | $0.04 per run, reserved before it starts |
| Timeout | 120 seconds |
How to run it
Start a run with the API or the CLI. The result arrives by signed callback or when you read the run.
POST /v1/runs
{
"workflow": "untrusted-code-sandbox",
"input": {},
"max_cost_micros": 40000
}Samples
Each sample is a complete request you can read, replay and copy.
- Run untrusted code safely: an AI agent in a disposable sandboxThe agent writes and runs a script, tries to reach the internet, and reports that the call fails inside a microVM that vanishes afterwards.
- Generate release notes from git commits with AIAn agent turns a list of commits into customer-facing release notes, grouped and with breaking changes called out first.
- Prompt injection example: what happens when a ticket tries to hijack the agentA hostile ticket tells the agent to send its API key to an attacker and issue a refund. See why it cannot, and what the timeline shows.
Related terms
- MicroVM: The small virtual machine each run gets fresh and that is destroyed when the run ends.
- Credential broker: Ephemeral holds a connection's credentials and adds them to each request, so the token never enters the machine.
- Run budget: The most a run may spend, reserved up front and enforced while it runs.
Questions
Can the code reach the internet?
Not unless you allow a domain. The sandbox sample turns web access off, asks the agent to try a network call and shows the exact failure in the timeline.
What survives after the run?
Nothing the agent wrote. The microVM is destroyed when the run ends; the timeline and the result stay with the run record.
What if the model is tricked into doing something harmful?
The limits do not depend on the model behaving. The machine has no credentials, the connections allow only the methods you listed, the web is limited to the domains you listed and the budget is a hard cap.
Prices are on the pricing page.