hardware-isolation

CreateOS Sandbox provides instant, hardware-isolated sandboxes for AI agents.

China has open-sourced CubeSandbox, a hardware-isolated sandbox for AI agents that cold-starts in under 60ms with only 5MB of memory overhead per instance, replacing Docker and E2B with a simple URL swap. It can run thousands of agents on one machine at the hardware level.

Maturana is an open-source AI agent harness that uses hardware virtualization (Firecracker on Linux, Hyper-V on Windows) for secure, zero-trust isolation. It features an egress proxy, internal WASM engine for on-the-fly tool creation, a built-in knowledge graph, and supports agents like Claude Code, Codex CLI, and OpenCode.