Vercel Sandbox

Executive Summary

Vercel Sandbox is Vercel's compute primitive for running untrusted, user-generated, or AI-generated code: each sandbox is a Firecracker microVM with its own filesystem and network, Node.js and Python runtimes, full root access via sudo, and millisecond startup.^[1] It went GA on January 30, 2026, already carrying production workloads for v0, Blackbox AI, and RooCode, and on April 8, 2026 the standalone Sandbox CLI (launched November 7, 2025) merged into the main Vercel CLI as vercel sandbox — the same day Enterprise sizes expanded to 32 vCPUs and 64 GB RAM.^[2][3]

The differentiated bet is billing. Active CPU pricing meters only the time code actively uses the CPU at $0.128/vCPU-hour — time spent waiting on network requests, database queries, or AI model calls is free — which Vercel claims yields up to 95% lower cost than wall-clock billing for bursty, I/O-bound agent workloads.^[4][5] Sandbox also anchors Vercel's agent stack: official guides cover running Anthropic's Claude Agent SDK and the OpenAI Agents SDK inside sandboxes, and the open-source Open Agents reference application (April 30, 2026) uses Sandbox as its execution layer.^[6][7][8] It is a separate product from Vercel AI Gateway, which handles model routing, not code execution.

---

Product Overview

Sandbox targets four jobs: executing untrusted code (agent output, user uploads, third-party scripts) safely, building interactive tools like code playgrounds and AI UI builders, testing agent-generated code in isolation with logs and live previews, and running development servers with exposed ports.^[1] Sandboxes run Amazon Linux 2023 with node26, node24 (default), node22, and python3.13 runtimes, as the vercel-sandbox user with sudo access — including system-privileged workloads like Docker-in-sandbox, VPN clients, and FUSE filesystem drivers.^[1]

Key Capabilities

Product Surfaces

---

Technical Architecture

Sandbox runs on the same Firecracker infrastructure that powers Vercel's build system. Authentication uses Vercel OIDC tokens (automatic in production on Vercel; vercel env pull for local development) or access tokens for external CI/CD.^[1] Sandboxes provision 1 or an even number of vCPUs from 2 to 32 (default 2), each bundling 2 GB of memory, plus 32 GB of ephemeral NVMe storage; the service runs only in the iad1 region as of June 2026.^[4]

npm i @vercel/sandbox   # JS/TS SDK
vercel sandbox          # CLI subcommand

For agent workloads, Vercel publishes a guide for running the Claude Agent SDK as a long-running process inside a sandbox — isolating an agent that executes shell commands and modifies files — and a parallel guide for the OpenAI Agents SDK doing data analysis with shell access inside an ephemeral microVM.^[6][7] Open Agents layers a web interface, an agent workflow layer with durable (not request-based) execution, and the sandboxed execution environment, with GitHub branch/PR automation; it requires PostgreSQL, OAuth, and optional Redis.^[8]

Key Technical Details

---

Strengths

• Active CPU billing fits agent workloads — agents spend most of their wall-clock time waiting on LLM calls; not billing I/O wait is structurally cheaper than per-second wall-clock metering for those patterns, by Vercel's claim up to 95%.^[4][5]
• Real production validation at GA — v0, Blackbox AI, and RooCode were named production users on launch day, not design partners on a waitlist.^[2]
• Persistence became the default — auto-save on stop, snapshots, and beta drives remove the "ephemeral-only" caveat that defined the early category.^[1]
• Root access including nested Docker — system-privileged processes (container runtimes, VPN clients, FUSE) run inside the microVM, which many managed sandboxes disallow.^[1]
• Enterprise headroom — 32 vCPU / 64 GB sandboxes, 2,000 concurrent sandboxes, and a 100,000 requests/minute control plane move it past toy-workload territory.^[4][3]
• First-party path into the default workflow — folding Sandbox into the main Vercel CLI makes sandboxed execution "a default-looking part of the developer workflow" rather than specialist tooling.^[3]

---

Cautions

• Single region — iad1 only as of June 2026; latency-sensitive users outside US East and data-residency buyers are out of scope for now.^[4]
• Active CPU cuts both ways — at $0.128/vCPU-hour versus E2B's ~$0.0504 wall-clock rate, compute-saturated workloads (builds, test suites pegging the CPU) can cost more on Vercel; the savings claim assumes I/O-bound patterns.^[4][5]
• 5-hour ceiling — maximum runtime duration is 45 minutes on Hobby and 5 hours on Pro/Enterprise; very-long-running agents must checkpoint and resume across sandboxes.^[4]
• The 95% figure is vendor-stated — the headline cost comparison comes from Vercel's own Sandbox-vs-E2B page, not an independent benchmark.^[5]
• Platform gravity — OIDC auth, the $20 Pro credit, and CLI integration all assume you live on Vercel; teams not deploying there get less leverage from the integration, per the comparison framing itself.^[5]
• Snapshot expiry default — snapshots expire 30 days after last use unless reconfigured, a foot-gun for infrequently-run workflows.^[4]

---

What Developers Say

Community discussion is mostly practitioners describing Sandbox inside their stacks; no high-drama pricing thread surfaced as of June 2026, and the sharpest criticism targets the architecture of Open Agents rather than Sandbox itself.^[9]

"I use bash-tool and Vercel sandbox to generate charts (Echarts) or tables (Tanstack table) from json data" — an HN commenter (sails)^[9]

"Happy to answer questions about the architecture (Anthropic Claude Agent SDK, Vercel Sandbox, ElevenLabs for voice)." — an HN commenter (davekiss), describing a tool built on Sandbox^[9]

"This is also very similar to Vercel's sandbox thing. The same technology?" — an HN commenter, on Cloudflare's competing sandbox launch^[9]

"This slows down agentic development in the mid to long run... you limit the freedom of the agent and thus his capabilities." — Michiel Voortman, criticizing Open Agents' agent-sandbox separation on InfoQ^[8]

The pattern: developers adopt Sandbox as a component inside agent architectures rather than debating it as a destination, and the skeptical voices question Vercel's agent-layer design decisions, not the microVM primitive.^[9][8]

---

Pricing & Licensing

Pro and Enterprise share list pricing; Pro usage draws down the plan's $20/month credit first, and Enterprise negotiates volume discounts.^[4]

All pricing as of June 2026.^[4] Vercel's worked examples land a 5-minute AI code validation at ~$0.03 and a 2-hour, 8-vCPU task at ~$2.73 assuming 100% CPU utilization — actuals run lower because I/O wait is unbilled.^[4]

Licensing model: Proprietary managed service metered across five dimensions (Active CPU, provisioned memory, creations, data transfer, snapshot storage); SDK/CLI code is public on GitHub.^[4][1]

Hidden costs: Provisioned memory bills wall-clock (in 1-minute minimums) even when Active CPU doesn't; data transfer at $0.15/GB includes package downloads; forgotten sandbox.stop() calls run the meter to the timeout.^[4]

---

Competitive Positioning

Direct Competitors

Within Vercel's own catalog, Sandbox is the execution primitive while Vercel AI Gateway is the model-routing layer — adjacent products that compose (Open Agents uses both patterns) but solve different problems; don't conflate them when evaluating.^[8]

When to Choose Vercel Sandbox Over Alternatives

• Choose Vercel Sandbox when: your app already deploys on Vercel, your agents are I/O-bound (LLM-call-heavy), and you want sandbox auth, billing, and CLI in the platform you already operate.
• Choose E2B when: you need platform neutrality, multi-region options, or your workloads saturate CPUs where wall-clock pricing is cheaper.
• Choose Sprites when: you need long-lived stateful environments that outlive any single run rather than a 5-hour-max execution primitive.

---

Ideal Customer Profile

Best fit:

• Teams already on Vercel adding agent code execution — the sandbox is one import and one OIDC token away^[5]
• LLM-call-heavy agent loops where unbilled I/O wait dominates the cost equation^[4]
• Products like AI app builders and code playgrounds needing millisecond starts and live previews^[1]
• Enterprises needing big single sandboxes (to 32 vCPU/64 GB) with contractual support^[3]

Poor fit:

• Data-residency or low-latency requirements outside US East — iad1 is the only region^[4]
• Workloads exceeding 5 hours per run without checkpoint/resume engineering^[4]
• CPU-saturated batch compute, where wall-clock competitors undercut the $0.128 active rate^[5]
• Teams avoiding platform consolidation on Vercel

---

Viability Assessment

Sandbox is strategically load-bearing for Vercel — it underpins v0 and the Open Agents push — which makes abandonment risk low and continued investment likely. The open question is whether active-CPU pricing plus platform bundling pulls agent-infrastructure spend away from neutral specialists, or whether single-region, Vercel-only positioning caps it at "default choice for Vercel shops."^[2][8]

---

Bottom Line

Vercel Sandbox is the platform-bundled entrant in the AI agent sandbox category: the same Firecracker isolation as E2B, persistent-by-default state, root access including nested Docker, and a pricing model genuinely shaped for agents — billing CPU work, not LLM wait time. For teams already on Vercel, it removes an entire vendor from the agent stack. For everyone else, the calculus is a vendor-stated cost advantage against a single US-East region, a 5-hour runtime ceiling, and deeper platform consolidation.

Recommended for: Vercel-deployed teams running I/O-bound agent code execution, AI app builders needing millisecond-start previews, and enterprises wanting large sandboxes under an existing Vercel contract.

Not recommended for: Multi-region or data-residency requirements, CPU-saturated batch workloads, runs beyond 5 hours, or teams deliberately avoiding Vercel lock-in.

Outlook: Expect region expansion and longer runtimes to be the tells of serious category ambition; with v0 and Open Agents built on it, Sandbox is infrastructure Vercel needs for itself — the safest kind to build on.

---

Research by Ry Walker Research • methodology