If your agent writes code and then runs it, that code is untrusted the moment the model emits it — a prompt injection or a hallucinated rm is one token away — and it needs a sandbox with a real boundary, not just a container. The question every founder shipping an agent hits in 2026 isn't whether to sandbox. It's which one, and this month Google changed the answer by entering the agent-sandbox market itself.

The short version: Cloud Run Sandboxes now run untrusted code at no additional charge inside a Cloud Run instance you already pay for — so if you're on GCP, isolation is nearly free at the margin. The dedicated microVM vendors (E2B, Fly, Vercel) still win when you need a boundary you can name in a security review and persistence that survives across agent turns. That's the whole trade.

The market splits three ways#

Strip out the marketing and every option on the table falls into one of three buckets, defined by what actually stops the untrusted code from touching things it shouldn't:

  1. Dedicated microVM vendors — E2B, Fly Machines, Vercel Sandbox. Each sandbox gets its own kernel via Firecracker, the same hardware-virtualization primitive under AWS Lambda. Strongest per-tenant boundary, purpose-built cold-start and persistence, at a per-second premium and a separate vendor relationship.
  2. Platform-bundled sandboxes — Google Cloud Run, Cloudflare. Isolation colocated with a platform you already deploy on. You trade a spelled-out security story for price and zero extra moving parts.
  3. gVisor players — Modal, and Google's separate GKE Agent Sandbox. A user-space kernel intercepts syscalls: a weaker boundary than a microVM on paper, but with density, compatibility, and — for Modal — GPUs sitting right next to the sandbox.

Pick your bucket first. The product choice inside it is mostly ergonomics — we walked the dedicated tier in detail in E2B vs Modal vs Daytona; this piece is about what the hyperscaler's entry does to that math.

What Google actually shipped — and what it won't say#

Cloud Run Sandboxes entered public preview running untrusted code inside your existing Cloud Run instances: zero network egress by default, a read-only container filesystem with a memory overlay for writes, and — the headline — no additional charge. Writes are discarded after execution; you shuttle data in and out with tar archives. Google demoed launching 1,000 sandboxes at ~500ms average start.

The no-premium model is what reframes build-vs-buy. If you're already on Cloud Run, the marginal cost of sandboxing agent code drops to roughly zero, and the pitch for a dedicated vendor has to clear a much higher bar.

Here's the part you should not skim: Google's preview post never says what isolates the code. It says "isolated execution boundaries" — not gVisor, not microVM, nothing you can put in a threat model. The strong, explicitly-gVisor isolation Google talks about belongs to a different product, GKE Agent Sandbox, which is built for exactly this untrusted-LLM-code job and says so. Don't let the two blur together. Until Google names the Cloud Run Sandboxes primitive, treat "how strong is this boundary?" as an open question — fine for your own code, worth a second look before you run genuinely hostile input.

When the dedicated vendors are still worth paying for#

Two things platforms treat as afterthoughts, dedicated microVM vendors ship as the product:

On cost among the dedicated set: per-second CPU/memory rates cluster near $0.05/vCPU-hr, and Vercel bills active CPU only — it doesn't charge while your code waits on I/O — which makes it the cheapest for bursty, network-bound agent work.

The one question that decides it#

Everything above collapses to a single fork:

Do you need isolation-strength-plus-persistence as a first-class product — or is "good-enough isolation at near-zero premium, colocated with the platform I already run on" the better trade?

The wrong move is standardizing on price alone and discovering, one incident later, that "isolated execution boundaries" meant less than you assumed. Name your boundary before you scale behind it.