Your AI agent isn't running in a sandbox — it's running on your machine

# Your AI agent is not running in a sandbox. It's running on your machine.

Open a terminal, start a coding agent — Claude Code, Cursor's terminal, any of the CLI ones — and ask it to clean something up. It writes a command. Then it runs the command. Not in a container you forgot you configured, not in a hosted environment somewhere. On the computer you are sitting at, with your permissions, against your files.

Most people using these tools have never actually checked this. It isn't hidden; it's just never stated. The default for a terminal agent is the terminal it was started in.

That is fine right up until it isn't. One bad command — a path that resolved to the wrong place, a cleanup step that was more thorough than you meant — and the thing that breaks is not a sandbox. It's your work.

AgentENV (kvcache-ai/AgentENV) is an MIT-licensed, self-hosted project that runs every agent action inside an isolated Firecracker micro virtual machine. The agent still does its work; it just does it inside a wall. A destructive command destroys a disposable VM, and your machine never sees it.

The numbers, all pulled first-hand from the GitHub REST API on 2026-08-08 rather than from a write-up:

• created_at 2026-07-23 — sixteen days old at the time of writing
• stargazers_count 2,962
• archived: false, disabled: false, last push the same day as the check
• MIT — read out of the repository's own LICENSE file, not off the badge

I am deliberately quoting the raw star count and the repo's age and not a stars-per-day rate. A rate implies sustained organic growth, and the external discussion around this project is genuinely thin: the two Hacker News submissions carrying it scored 1 point and 3 points with no comments. It is a real, actively-maintained project with a lot of stars and very little conversation. Both halves of that are true and you should hold both.

You've hired a contractor. He needs access to get the work done. You don't hand him the front door key to the whole house — you hand him one room, and the room is the only thing he can affect.

That's the whole idea. The agent gets a room. The room is a micro-VM. Whatever happens in the room stays in the room.

This is not a five-minute laptop install, and anyone telling you otherwise hasn't read the prerequisites.

The server side needs a real Linux box with hardware virtualization — kernel 6.8 or newer and access to /dev/kvm. That is not macOS and it is not, in general, your laptop. The aenv CLI runs on Linux and macOS on x86_64 and arm64, but the CLI is the client; the thing that needs the Linux host is the part that actually does the isolating.

So the honest shape of this is: free, but you need somewhere to put it. A cheap VPS, a spare machine, a work Linux box. If you don't have one of those, the tool is not for you today.

The paid alternative most people compare it to, E2B, starts at $150/month on its Pro tier plus usage-based charges on top (checked against e2b.dev/pricing plus two independent write-ups). There is a free hobby tier with a one-time credit. The comparison worth making is category-level — both are sandboxes for AI agents, one is hosted and billed, one is free and self-run.

One claim I cut and want to name. The project's README says its HTTP API is drop-in compatible with a well-known paid competitor's SDK. Every mention of that I could find — the press write-ups, the syndicated posts — restates the README's own wording, with no independent test behind it and no acknowledgement from the other side. I could not corroborate it, so it is not in the video and it is not a reason given here. If you're evaluating AgentENV, test that claim yourself before you build on it.

The tool needs a Linux server. The habit doesn't.

Before any AI agent touches your computer, ask one question: where is this actually running? If the answer is "here", you now know what you're accepting, and you can decide whether that's fine for this task. Most of the time it is. The times it isn't are the ones that cost you a weekend.

That question is free, it takes two seconds, and it works on every agent you will ever try.

Comment SANDBOX on the post and I'll send it over, or just take it from the link — nothing is gated on the comment. Inside:

1. A three-minute AgentENV quickstart, written against the project's actual prerequisites rather than its headline
2. A prerequisite checker you can run on your own box — it reads your kernel version and looks for /dev/kvm, makes no network calls, installs nothing, writes nothing, and exits with a clear "fix the machine, not this script" if you run it on macOS
3. The isolation checklist — the questions to ask about any agent runtime, whether or not it's this one

sharpendaily.co/kit/sandbox

---

*Sources: GitHub REST API (api.github.com/repos/kvcache-ai/AgentENV), the repository's own README and LICENSE, e2b.dev/pricing, Hacker News (Algolia API). All checked 2026-08-08/09. Where a claim could not be independently corroborated it was cut, not softened.*