Infrastructure / Deployment

Vercel Sandbox

Closed-source compute primitive (GA in 2026) that runs untrusted/agent-generated code in isolated Firecracker microVMs with millisecond startup, default Node 24 + Python 3.13 runtimes, filesystem and shell access. Picked by teams already on Vercel building AI agents that need a managed sandbox tightly integrated with the AI SDK. The execution layer behind Vercel Open Agents.

Vercel Sandbox - GA ephemeral compute primitive for running untrusted/AI-generated code in isolated Firecracker microVMs; docs last updated 29 May 2026. Open SDK/CLI (vercel/sandbox on GitHub, @vercel/sandbox npm + vercel.sandbox Python) over Vercel's proprietary managed cloud. Verified live June 2026.

Openness

1 high confidence

1.0

source: closed
service: proprietary Vercel Fluid-compute managed cloud (no self-host of the Firecracker microVM plane)
open-part: client SDK/CLI only (@vercel/sandbox JS + Python, vercel/sandbox on GitHub)
license: Proprietary, proprietary service

Closed managed service. The SDK/CLI are open, but they are only a client for Vercel's proprietary microVM cloud, which cannot be self-hosted; an open client over a closed runtime is not open_core (the core is proprietary). Reclassified from open_core; sits with the other proprietary sandbox clouds (Google Cloud Run, Fly Sprites, Northflank).

https://vercel.com/docs/sandbox recorded 2026-06-04
Firecracker microVM isolation; SDK/CLI on GitHub vercel/sandbox; managed Vercel cloud, pay-for-active-CPU

Adoption

4 medium confidence

4.0

npm @vercel/sandbox ~9.06M downloads in the last 30 days (npm registry API). Package-manager pulls include CI/mirror inflation and overstate distinct human users, so reach is placed at the 1M-10M band (level 4) rather than >10M; GA status + large Vercel install base corroborate genuine production use.

https://api.npmjs.org/downloads/point/last-month/@vercel/sandbox recorded 2026-06-04
~9,062,145 downloads May 4-Jun 2 2026
https://vercel.com/docs/sandbox recorded 2026-06-04
GA ephemeral compute primitive, JS+Python SDK

Capability

4 high confidence

4.0

Firecracker microVM isolation (top tier) + ms cold-start + persistence/snapshots make it a strong agent sandbox; held at 4 rather than 5 because the managed-runtime breadth is narrower (Node/Python first-class) than Lambda's any-runtime/any-image frontier and scale is not at Lambda's proven level. Independent ComputeSDK TTI benchmarks measure ~390ms median cold-start (9th of 19 sandbox providers); the vendor's 'ms startup' framing is optimistic versus the measured hundreds of ms, though still solidly sub-second.

https://vercel.com/docs/sandbox recorded 2026-06-04
Firecracker microVM per sandbox, ms startup, persistent+snapshot, node/python runtimes, up to 45m
https://www.computesdk.com/benchmarks/sandboxes/ recorded 2026-07-09
ComputeSDK TTI leaderboard (independent, 100 iters/day, 2026-07-09 run): median time-to-interactive ~390ms sequential / ~490ms burst @100 concurrent; 9th of 19 providers

Unchanged since 2026-07-30 (last edited, not re-checked)