MicroVM Sandboxes for AI Agents: Isolation, State and Operational Control

MicroVM sandboxes give user- or AI-generated code a dedicated virtualised environment with stronger isolation than an ordinary application process. They are useful for coding assistants, data tools and multi-tenant platforms where untrusted code must run.

Isolation is only one control. A secure sandbox also needs restricted networking, scoped credentials, clean images, resource limits, evidence and a lifecycle that prevents one task’s state leaking into another.

What changed with AWS Lambda MicroVMs

AWS announced Lambda MicroVMs in June 2026, describing VM-level isolation, rapid launch and resume, dedicated endpoints and state preservation for up to eight hours. Availability was initially limited to specified AWS regions.

The release reflects rising demand for safe execution of code produced by people or agents. It is one implementation option, not a universal substitute for containers, functions or managed jobs.

Choose the boundary by threat

A conventional function is appropriate for code your team owns with short execution and minimal state. A container may serve trusted workloads requiring custom dependencies. Use a MicroVM when separate kernels, per-session state or a stronger tenant boundary justify added lifecycle complexity.

Document the attacker: a curious user, malicious uploaded code, prompt-injected agent, compromised package or cross-tenant adversary. The control cannot be chosen from the word “AI” alone.

Build a minimal execution contract

Define:

• approved base image and package sources;
• CPU, memory, storage and execution limits;
• allowed input and output formats;
• network destinations and protocols;
• credentials available to the job;
• state duration and deletion;
• logs and artefacts retained;
• stop, suspend and resume behaviour.

The agent should request an execution task through a typed API. It should not configure arbitrary infrastructure.

Network and identity are common escape routes

A well-isolated kernel can still send secrets to the internet if outbound access is open. Default-deny egress, then allow only required package mirrors or APIs through controlled proxies.

Issue short-lived credentials for the current task and resource. Do not mount developer cloud credentials or production secrets. Separate the orchestration service identity from the code’s identity.

These controls complement prompt-injection security because malicious content may convince an agent to misuse legitimate tools.

State changes the risk

Stateful sessions improve iterative coding and analysis, but they retain downloaded packages, outputs and potentially sensitive data. Bind state to a user and task, encrypt it, set an expiry and provide explicit destruction.

Never resume a snapshot under a different customer context. Record image and snapshot versions so an incident can be reconstructed without preserving more data than policy permits.

Secure the supply chain

Pin dependencies, verify provenance where possible and scan images. Route builds through an approved pipeline rather than letting each agent fetch arbitrary installers. Keep production deployment a separate, human-reviewed process.

Our AI coding agent governance guide covers review, tests and repository controls around the sandbox.

Observe without collecting everything

Capture task ID, actor, image, resource use, network decisions, exit status and produced artefacts. Avoid indiscriminate capture of customer content. Define access and retention with security and privacy owners.

Alert on resource exhaustion, blocked network attempts, repeated failures and unexpected persistence. Regularly test tenant separation and deletion.

A controlled rollout

Begin with disposable, no-network environments and synthetic repositories. Add an approved package proxy, then read-only internal data. Introduce task-specific writes only after threat testing.

Measure launch latency, execution success, cost, clean-up reliability and review effort. Test provider and region failure. A cloud and DevOps service should automate image release and evidence, while security engineering verifies the boundary.

MicroVMs make a strong primitive available more conveniently. They do not make arbitrary code safe by default. Contact AUZtec to review the complete execution path before an AI agent receives code-running authority.