Tencent Open-Sources CubeSandbox: AI Agent Execution Sandbox with 60ms Cold Start and Hardware Isolation
In July 2026, Tencent Cloud open-sourced CubeSandbox, a hardware-level isolated sandbox for AI Agents based on RustVMM + KVM. It features cold start time of less than 60ms and memory overhead of less than 5MB per instance, and natively compatible with E2B SDK. The project has exceeded 10,000 GitHub Stars, and has become a popular infrastructure-level solution amid frequent Agent security incidents. This article sorts out its technical architecture, security mechanism, E2B migration steps and its connection with Agent ecosystems such as OpenClaw, to help developers evaluate whether it is suitable for building their own Agent execution environments.
Read MoreTencent CubeSandbox Open-Sourced: Hardware-Level AI Agent Execution Environment with 60ms Cold Start Time
In April 2026, Tencent Cloud fully open-sourced CubeSandbox under the Apache 2.0 license. Based on RustVMM and KVM MicroVM, this project provides hardware-level isolated sandboxes for AI Agents: it features cold startup time of less than 60ms, additional memory overhead of less than 5MB per instance, and natively compatible with the E2B SDK. The CubeVS component implements network isolation and outbound traffic control via eBPF. This article verifies official data and architecture, introduces acceleration principles such as resource pool pre-creation and snapshot cloning, and provides quick experience steps for the E2B SDK, which is suitable for developers paying attention to Agent infrastructure and self-hosted sandboxes.
Read More