Topic

Exploring and Practicing Secure Sandboxing for Large-Scale AI Agents

As AI Agents are increasingly deployed at scale for code execution, tool calling, and autonomous tasks, sandbox infrastructure faces three major challenges: startup latency must be low enough to keep up with real-time interactions; resource overhead must be low enough to support thousands of concurrent instances; and isolation must be strong enough to defend against multi-tenant attacks involving untrusted code. Containers share the host kernel and provide insufficient isolation, while virtual machines suffer from slow startup and high memory overhead. Neither approach is well suited to large-scale Agent workloads. CubeSandbox addresses these challenges with a MicroVM + snapshot architecture. Instead of performing a full system boot, it restores instances from snapshots to achieve millisecond-level cold starts—approximately 60 ms for a single instance and 137 ms P99 at 50-way concurrency. Read-only sharing and copy-on-write reduce per-instance memory overhead to under 5 MB, enabling thousands of instances on a single host. Independent kernels and zero-trust egress controls provide hardware-level isolation. Native support for Snapshot, Clone, Rollback, and automatic suspend/resume makes parallel exploration and failure recovery for Agents nearly cost-free. Drawing on real-world benchmarks and lessons learned from Tencent Cloud production environments, this talk will examine the key engineering trade-offs behind the architecture: which optimizations actually work, where performance can degrade, how to diagnose bottlenecks, and how to migrate from existing solutions such as E2B with zero code changes. The content is based on first-hand experience from large-scale production deployments, providing attendees with practical selection criteria, optimization techniques, and a checklist of common pitfalls. Outline 1. Why AI Agents Need a New Generation of Sandboxes Specific bottlenecks of traditional containers and virtual machines in LLM code execution, parallel reinforcement learning exploration, and Agent evaluation Challenges around isolation, startup latency, and resource overhead Why traditional approaches struggle to meet the requirements of large-scale Agent workloads 2. CubeSandbox: Architecture and Positioning The overall MicroVM + Snapshot architecture Control plane and data plane design Key differences and selection criteria compared with containers, virtual machines, E2B, and other approaches 3. Key Technologies and Engineering Challenges Millisecond-level cold starts: snapshot restoration, resource pooling, and on-demand memory loading High density with low overhead: read-only sharing, copy-on-write, and shim/VMM consolidation Hardware-level isolation: KVM-based independent kernels, eBPF-based egress control, and dynamic secret injection State management: Snapshot, Clone, Rollback, and automatic suspend/resume 4. Performance Analysis and Production Experience Comprehensive benchmark results on Tencent Cloud BM15 bare-metal servers Real-world trade-offs involving overcommitment, dirty-page growth, snapshot size, and restore latency How to identify effective optimizations, understand performance regressions, and accurately attribute bottlenecks 5. Ecosystem Compatibility and Future Evolution Zero-code migration enabled by native E2B SDK compatibility Multi-language SDK support Future plans including cross-host snapshots and enhanced scheduling Key Takeaways Attendees will gain a systematic understanding of how to select and deploy sandbox infrastructure for AI Agents, including: Why MicroVM + Snapshot is emerging as a natural direction for large-scale Agent sandboxing How CubeSandbox combines millisecond-level cold starts, copy-on-write-based high-density deployment, hardware-level isolation, and snapshot/clone/rollback capabilities to turn sandboxes into a unified, schedulable infrastructure layer The current state of E2B ecosystem compatibility and multi-language SDK support Practical selection criteria, performance optimization techniques, and multi-tenant isolation lessons from real-world production deployments