Alibaba Cloud Discloses Agent Sandbox Architecture for Production-Grade Agent Execution

In the past, when enterprises deployed large model applications, infrastructure attention focused mainly on inference efficiency: response latency, throughput, and compute costs. But when Agents enter real business operations, the execution environment itself becomes an unavoidable layer in system design. Enterprises need to determine which data and systems an Agent can access, in what environment code, browsers, and other tools execute, and how different tasks are isolated from one another; when request volume suddenly rises, the platform must also quickly prepare large numbers of independent environments; for longer-running tasks, execution state, temporary files, and intermediate results also need to be preserved to avoid starting over after a single interruption.

It is precisely amid this change that the sandbox, a security mechanism traditionally used mostly to isolate untrusted code and processes, has gradually evolved into an important component for carrying Agent execution. Alibaba Cloud officially debuted Agent Sandbox for enterprise-grade AI Agents in April of this year and opened public beta, and at the 2026 Yunqi Conference it further disclosed its technical architecture and more industry practices.

In a complete Agent Infra setup, the model is responsible for reasoning and generating the next action, while the orchestration system is responsible for organizing tasks, coordinating tool calls, and executing workflows. When a task needs to run code, access files, or operate a browser, a controlled execution environment is also needed—the agent sandbox fills this role. It sets boundaries for processes, files, networks, storage, and system permissions, preventing different tasks from interfering with one another and also reducing the impact of a single task on the host system and other business operations.

As Agent tasks shift from short interactions to long-horizon execution, the sandbox must also manage the complete lifecycle of the runtime environment, including creation, startup, pause, state preservation, recovery, and reclamation. As a result, the agent sandbox sits at the execution layer of Agent Infra, carrying the action plans generated by the model and orchestration system, translating tool calls into real code, process, and environment operations, while managing security boundaries, resource usage, and runtime state during execution.

Yi Li, head of container and sandbox R&D at Alibaba Cloud Intelligence Group, summarized Agent Sandbox in an interview with Machine Heart as "essentially a computer for the Agent to use." Unlike traditional virtual machines that mainly provide general-purpose computing environments for people and applications, it targets execution tasks driven by models: Agents may run dynamically generated code and access files, networks, and external systems, so the sandbox needs to establish complete security boundaries at the compute, storage, and network layers; at the same time, whether for Agent Serving or parallel exploration in RL, large numbers of sandboxes must be able to be created quickly and put into operation.

Different tasks place different emphases on execution environment requirements. Training and autonomous iteration require large numbers of environments for parallel experimentation, with repeated resetting and reuse of state; online Agents, meanwhile, need to quickly start environments after requests arrive and maintain security boundaries throughout tool calls, long sessions, and pause-resume processes. Along these two types of workloads, the core scenarios of Alibaba Cloud Agent Sandbox are divided into two groups: one is oriented toward training and evaluation, meeting the needs of model reinforcement learning Agentic RL and model RSI self-evolution; the other is oriented toward production applications, providing execution environments such as tool calls and code execution for Agent Serving and Agent Use.

Scenario differences translate into access and management methods. Developers care about whether they can call it quickly, while platform teams care about whether the sandbox can be incorporated into existing clusters and governance systems. Accordingly, Alibaba Cloud Agent Sandbox provides two API access methods: Developer API is compatible with E2B, suitable for developers to quickly create and operate sandboxes and also convenient for migrating existing Agent applications; Kubernetes API targets enterprise platforms and infrastructure teams, suitable for sandbox resource management, security governance, and daily operations, and can be combined with existing Kubernetes clusters, permission systems, and operations processes to uniformly manage large-scale Sandboxes.

It should be noted that Developer API compatibility with E2B means its developer interface design is constrained by the E2B ecosystem; and the actual migration costs and compatibility boundaries of Alibaba Cloud's compatibility with the E2B and Kubernetes ecosystems have not currently been disclosed in detail.