Two developers at an Indian agency office review a coding task on laptops beside a wall of task notes.

Vercel · Agent stack

The agent wrote a script. Run it where it cannot reach your customer data.

Agents now write code to answer questions: a Python script to read a spreadsheet, a fix for a failing test. Running that code on your own server means trusting every line. Sandbox starts a separate Linux microVM for each job, with its own kernel. You set which hosts it may call, and credentials are added on the way out, so they never enter the box.

Salesforce consulting partner since 2010 · MVP Hall of Fame · 200+ agents in production · UAE, India and US desks

The problem

Where running AI code goes wrong today.

What Sandbox is

Sandbox, in plain words.

Facts from Vercel’s own pages, checked on 16 October 2026. The sources are at the end of this page.

What it is
An on-demand, isolated Linux microVM that runs any code through an SDK or CLI. Generally available since 30 January 2026.
Isolation
Each sandbox runs in its own Firecracker microVM with a dedicated kernel, on the infrastructure that runs Vercel’s builds.
Network and keys
A firewall with allow-all, deny-all or your own rules, changeable while it runs. Credentials are injected on the way out and never enter the sandbox.
What is inside
Ubuntu with Node.js 24 and Python 3.14, sudo and apt. Docker is supported, or you bring your own image. Claude Code, Codex and OpenCode are in the base image.
How long it runs
A session starts at 5 minutes and extends to 45 minutes on Hobby or 24 hours on Pro and Enterprise. Snapshots and Drives keep files between runs.
Where it runs
Any of the 19 Vercel regions, including Mumbai (bom1). There is no region in the UAE or Saudi Arabia.

How it works

From code an agent wrote to a result you can check.

Five steps. The code runs in its own machine and reaches only the hosts you allow. The box is gone when the job ends, unless you keep it.

Five steps: the agent asks for a sandbox, a microVM starts, the code runs inside, results come back, the box is stopped.

Infographic

The same steps are written out below.

Step by step

What happens at each step.

  1. Create

    Your agent asks for a sandbox

    Through the SDK or the CLI, in the region you pick.

  2. Boot

    A microVM starts

    From Vercel’s image or your own, with its own kernel.

  3. Run

    The code runs inside

    It writes files and runs commands. Network rules decide which hosts it may reach, and keys are added on the way out.

  4. Read

    Results come back

    Exit codes, output and logs, or a live URL on an open port.

  5. Stop

    Stop, snapshot or keep it

    Throw it away, save a snapshot, or let it persist and resume later.

How it fits together

Where Sandbox sits between the agent and your systems.

The agent runs in your app, with the AI SDK or eve. When it writes code, that code runs in a sandbox. Results go back to the agent, and only actions a person approved reach Salesforce or your database.

An agent hands its code to a sandbox with network rules, gets results back, and approved changes go to Salesforce.

Infographic

Where it sits next to the systems you run today.

Use cases · worked examples

One worked example in each industry.

How Sandbox fits into the work of the industries we serve, one step at a time.

  1. A client statement is read by a script in a sandbox, checked by the manager and saved as a review in Salesforce.

    Example 1 · Financial services, Mumbai · Infographic

    Relationship manager at a Mumbai wealth advisory firm

    Today: Clients send portfolio statements as spreadsheets. Building one review takes me an afternoon in Excel.

    After: An agent writes a Python script to read the statement and runs it in a sandbox in Mumbai. The sandbox can reach only the price feed the firm allows. The manager checks the draft before it goes to Salesforce.

    Worked example, step by step

    1. 11:00Relationship manager. Uploads a client’s statement to the firm’s internal app.
    2. 11:01Agent. Writes a Python script to read the holdings and work out the allocation.
    3. 11:01Sandbox. Starts in Mumbai (bom1) and runs the script. Only the price feed host is allowed out.
    4. 11:03Agent. Reads the output and drafts a one-page review with the allocation table.
    5. 11:20Relationship manager. Checks the figures against the statement, edits one line and approves.
    6. 11:21App. Saves the review on the client’s record in Salesforce and stops the sandbox.

    The manager starts from a checked draft, and the statement is processed in a locked box in Mumbai.

    Financial services
  2. A client bug is fixed by a coding agent inside its own sandbox, reviewed by a developer, then the sandbox is stopped.

    Example 2 · Digital agency, Bengaluru · Infographic

    Engineering lead at a Bengaluru digital agency

    Today: We use coding agents on client projects. I cannot let one run npm install on a laptop that holds every client’s keys.

    After: Each coding task runs in its own sandbox, with Claude Code or Codex from the base image. The agent can reach the package registry and GitHub only. A developer reviews the pull request before anything merges.

    Worked example, step by step

    1. 10:00Project manager. Logs a client bug: the contact form drops the phone field.
    2. 10:02App. Starts a sandbox from the base image with the client’s repository.
    3. 10:02Coding agent. Installs packages inside the sandbox and reproduces the bug.
    4. 10:20Coding agent. Fixes it, runs the tests and opens the site on a port with a public URL.
    5. 10:30Developer. Checks the running site, reviews the diff and approves the pull request.
    6. 10:31App. Stops the sandbox and closes the task on the client’s project record in Salesforce.

    Coding agents work on one client’s code at a time, with no other client’s keys in reach, and a developer approves every merge.

    Digital agencies
  3. A till export sent on WhatsApp is analysed in a sandbox; a summary comes back and the manager approves the new order.

    Example 3 · Restaurants and cafes, Riyadh · Infographic

    Owner of a four-branch cafe group in Riyadh

    Today: Every Sunday I export sales from the till and try to work out which branch sold what. It takes my whole morning.

    After: The owner sends the export on WhatsApp. An agent writes the analysis and runs it in a sandbox with no outside network, then sends back a summary and a chart. The operations manager approves any change to next week’s orders.

    Worked example, step by step

    1. Sun 08:00Owner. Sends last week’s till export to the group’s WhatsApp number.
    2. Sun 08:01Agent. Writes a script to total sales by branch, item and hour.
    3. Sun 08:01Sandbox. Runs the script with no outside network and returns a table and a chart.
    4. Sun 08:03Agent. Sends the summary on WhatsApp and suggests a smaller croissant order for one branch.
    5. Sun 09:00Operations manager. Approves the new order. It is saved on the supplier’s record in Salesforce.

    The owner reads Sunday’s numbers over coffee, and order changes still go through the operations manager.

    Restaurants and cafes
Examples of the work, not client stories. Times in each example show the order of events, not a measured result.

Is it for you

When Sandbox fits, and when it doesn’t.

Good fit

Not for you yet

An agent writes or runs code nobody reviewed
Your code is written and reviewed: a normal function is enough
Customers upload files your app has to process
Files must be processed inside the UAE or Saudi Arabia
Your team uses coding agents such as Claude Code or Codex
One session must run for days: 24 hours is the limit per session
Some jobs run longer than a function allows
You want the sandbox to decide what the agent may do: it limits reach, and the rules are still yours

What Mindcat does

We build it, then we run it.

The assessment is free: a short read of the org and a written note. If you go ahead, the first build week is a fixed AED/SAR 14,900 (about USD 4,050), credited in full when you sign the build within 60 days. After go-live, we keep it patched, watched and changing every month.

FAQ

What teams ask about Sandbox.

How is this different from running code in a normal function?
A function runs code you wrote and reviewed. Sandbox is for code you did not write: what an agent generates or a customer uploads. Each sandbox gets its own microVM and kernel, with its own network rules.
Does a sandbox make an agent safe?
It limits what the code can reach. It does not decide whether an action is right. Our post on agent sandboxes and policy, at mindcat.ai/blog/ai-agent-sandbox-policy, covers that gap and the rules we add on top.
Can the sandbox run in the UAE or Saudi Arabia?
No. Sandbox runs in all 19 Vercel regions, and none is in the Gulf. Mumbai (bom1) is the closest, and snapshots and Drives stay in the region where they were made. We confirm the region per project before you sign.
What does it cost?
As of 16 October 2026, Pro pays $0.128 per active CPU hour and $0.0212 per GB-hour of memory at Washington (iad1) rates, plus $0.60 per million sandboxes created. CPU is not charged while the code waits on a model or the network. Hobby includes a small monthly allowance and is for non-commercial use only.
How long can a job run?
A session starts at 5 minutes and can be extended to 45 minutes on Hobby or 24 hours on Pro and Enterprise. Stopping and resuming resets that limit, and snapshots keep the files.

Sources

Where these facts come from.

Start here

Tell us what you want built, and where it runs today.

One or two lines is enough. You hear back within 24 hours from the person who signs the work.

Where are you?

Salesforce consulting partner since 2010 · MVP Hall of Fame · 200+ agents in production · UAE, India and US desks