# AgentRun: Open-Source Sandbox for AI Agents By Ravi Krishnamurthy · 2026-11-13 · Source: https://www.activepieces.com/blog/agentrun-open-source-sandbox-for-ai-agents --- AgentRun is a secure, isolated environment for executing the Python code generated by AI models, which can be managed through platforms like [Activepieces](https://www.activepieces.com) to ensure workflows remain efficient, so that outputs translate into completed system tasks without risking host infrastructure. ![A large robot reaching into a glass display case to move a small chess piece.](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/907353db-7ba9-4323-82a2-b4faa17bde62/agentrun-open-source-sandbox-for-ai-agents-illus-c285f73b.webp) By **decoupling the reasoning engine** from the execution layer, it allows developers to move beyond simple text-based responses into stateful, multi-step workflows. ## Secure AI agent code execution environments ### The transition from static prompts to executable code Modern agentic work requires a shift from stateless chat interactions to durable execution where the system retains progress across failures. When a model like Claude Fable 5.2 from [Anthropic](https://www.anthropic.com) generates a complex script for long-horizon data analysis, a standard API call often lacks the persistence to handle network timeouts or process restarts. Nobody notices for three days. By then the sync has written the same record **eleven times**. This leads to "zombie" tasks where the agent loses its place in a sequence, forcing a complete and costly re-run of the logic. ![A row of identical rubber ducks on a conveyor belt, with one duck appearing eleven times in a row.](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/ed09266f-6483-43fc-b063-733513ea6385/agentrun-open-source-sandbox-for-ai-agents-illus-15c30701.webp) By providing a dedicated control plane, AgentRun ensures that a process restart does not end the agent's run, so the system can recover and continue from its last verified state. In these scenarios, the control plane allows the system to recover and continue without immediate service degradation for the end user. This is particularly critical when using high-volume models like Claude Haiku 5.5 for latency-sensitive tasks. ### AgentRun's Apache 2.0 open-source license Parcha AI released AgentRun under the **Apache 2.0 license** to provide an open-source alternative to proprietary, black-box execution environments. This licensing choice allows teams to self-host the sandbox, which means sensitive data never leaves the local VPC during code execution. In [Activepieces](https://www.activepieces.com), every connector is an agent tool. A integration registered once runs as a flow step and a schema on a per-project MCP server, so models call the same logic structured flows use without a second migration. MoneyGram and FundingSocieties run this to keep agent actions in sync with their automation library, a mechanism checkable in the Integrations Framework and MCP Server documentation within the open source repo. ![Activepieces workflow builder showing a Skyvern agent task step with API configuration fields and failure handling options.](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/e773f985-47ff-4e08-b329-e17a067db6e5/activepieces-vs-temporal-for-workflow-automation-4b459e5d.webp) To establish a local instance of the AgentRun server and provide a stable endpoint for agentic code requests, follow this sequence: 1. Verify the local environment is running Node.js version 24.22.3 or higher to ensure compatibility with the core runtime. 2. Clone the [Parcha-ai/agentrun](https://github.com/Parcha-ai/agentrun) repository to pull the latest stable build. 3. Run Docker Compose with the specific instruction to mount the `/data` directory, which allows the sandbox to persist stateful information between container restarts. 4. Access the server interface on port 7340 to begin managing and monitoring your agents' runs. The system confines every script generated by a model to a restricted container. Once the server is live, the focus shifts to managing the specific constraints of the execution environment. ## Isolated code execution solves the agent reliability problem Isolated code execution ensures that an AI agent can perform computations and manipulate data without risking the integrity of the host system or losing progress during network interruptions. By moving logic out of the transient prompt window and into a controlled environment, developers prevent the "hallucination loops" that occur when a model attempts to simulate math or file operations it cannot actually perform. ### Durable Agents and state recovery after failures Durable agents maintain a persistent record of their execution context, allowing them to resume complex workflows even if a specific API call or container instance crashes. According to [Docs](https://docs.claude.com/en/docs/about-claude/models/overview), in standard stateless environments, a timeout during a long-running task with a model like Claude Opus 5.5 results in the total loss of all intermediate variables and local file edits. When a process is interrupted, AgentRun maps execution to a persistent volume so the agent restarts with its previous file system state intact. Because the ephemeral nature of a runner does not dictate the lifespan of the data, this separation of concerns allows for multi-step tasks that span hours. Consequently, developers can build agents that perform deep data cleaning or multi-file refactoring without writing custom checkpointing logic for every script. ### Secure Python sandboxing for untrusted code execution AgentRun is a restricted Python environment that prevents generated code from accessing sensitive host resources or making unauthorized network calls. Platform analysis shows that when a model such as GPT-6 Astra generates a script to analyze a local CSV, a hardened sandbox executes the code rather than the user's primary machine. ### Comparing managed and self-hosted security This isolation stops a single malicious or malformed command from compromising the local directory. [Openai](https://openai.com/chatgpt/pricing) states that while the ChatGPT Plus plan costs $20 per month for advanced tool access, it operates within a managed ecosystem where the user has limited control over the underlying container configuration. ![A workflow execution interface showing a completed two-step Square OAuth token revocation flow with HTTP configuration](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/ab58d76a-e150-4da2-b368-e9390d90658a/how-to-evaluate-telemetry-dev-llm-observability-bc2ee918.webp) AgentRun is the same level of isolation in a self-hosted context. **By moving logic out of the transient prompt window and into a controlled environment, developers prevent the "hallucination loops" that occur when a model attempts to simulate math or file operations it cannot actually perform.** ### Kernel-level isolation and network filtering The system provides **kernel-level isolation** that prevents the Python process from seeing the host's process tree. It uses read-only root filesystems. These filesystems ensure any library injections are wiped when the runner closes. Finally, network egress filtering blocks the agent from sending internal data to external endpoints unless explicitly permitted. By enforcing these boundaries, the system transforms the high-reasoning output of models like Gemini 4 Carbon into safe, actionable operations. This shift allows organizations to deploy agents against internal datasets without the risk of an LLM-generated "rm -rf" command escaping the intended workspace. ## Integrating AgentRun into existing automation workflows AgentRun functions as a durable execution platform that converts high-level instructions into isolated code runs within a secure environment, preserving state across interruptions. By decoupling the reasoning engine from the execution shell, developers ensure that a logic error or malicious injection in the model output cannot compromise the host system's file structure. ### Triggering code execution with HTTP requests To trigger code execution, the automation platform sends a structured POST request to the AgentRun endpoint containing the script and its required dependencies. This synchronous connection returns the standard output or error logs directly to the workflow, meaning the next step in the sequence can immediately use that data for conditional logic. Because AgentRun handles the container lifecycle automatically, the workflow designer does not need to manage server spin-up times or teardown scripts. ### Managing external execution providers AgentRun serves as a unified management layer that can orchestrate code across various third-party sandbox providers. While it includes a native Docker-based runner for local use, it also acts as a gateway to specialized environments like E2B, Daytona, and Modal. E2B and Daytona provide cloud-based sandboxes specifically optimized for AI agents, offering fast startup times and pre-configured development environments. Modal focuses on serverless GPU and high-performance compute tasks, allowing the agent to scale horizontally for heavy data processing. By using AgentRun as the central controller, developers avoid vendor lock-in and can route tasks to the environment best suited for the specific script. The system manages the authentication and communication with these providers, presenting a consistent API to the AI agent regardless of where the code actually runs. The breadth of environments AgentRun can target demonstrates the versatility of this connection. | Environment Category | Supported Sandboxes / Platforms | | :--- | :--- | | Cloud/Container | Docker, E2B, Daytona, and Modal | | Desktop | Docker, E2B, or Orgo | | Mobile | Android phone harness | | Web | Browserbase or Kernel | _Prices and plan limits checked against [github.com](https://github.com/Parcha-ai/agentrun/blob/main/README.md) and [agentrun.ai](https://agentrun.ai/platform/durable-agents) and [docs.claude.com](https://docs.claude.com/en/docs/about-claude/models/overview) and [openai.com](https://openai.com/chatgpt/pricing) and [gemini.google](https://gemini.google/subscriptions) on November 13, 2026._ This setup allows a single automation flow to move from a cloud-based Python script to a local desktop action without changing the API structure. ### Configuring OpenAI-compatible providers for agent logic AgentRun utilizes an OpenAI-compatible API format to receive instructions from frontier models, allowing it to integrate with any provider that supports standard tool-calling schemas. When using a reasoning-heavy model like Claude Opus 5.5 or GPT-6 Astra, the agent identifies when a task requires computation and formats the code block for the AgentRun tool. You will not find this in the logs, because the failure never raised an error. This compatibility means developers can swap a high-latency model for a faster alternative like Gemini 3.5 Flash-Lite or GPT-6 Luna simply by updating the base URL and API key in the configuration. ### AgentRun support for Model Context Protocol servers The Model Context Protocol (MCP) acts as a standardized interface for AgentRun to pull in external data sources, such as documentation or database schemas, before executing code. By connecting to an MCP server, the agent gains a precise map of the environment it is working in, which reduces the likelihood of the model hallucinating non-existent library functions. This protocol-based extension ensures that as new tools are added to the ecosystem, AgentRun can consume their capabilities without requiring a custom integration for every unique data source. ## Operational costs of self-hosted sandboxes versus managed services Self-hosting AgentRun eliminates the per-execution premiums and recurring idle-resource fees that characterize managed agent environments. While providers like Anthropic or Google offer integrated tool-use capabilities for models such as Claude Opus 5.5 or [Gemini](https://gemini.google/subscriptions) 4 Carbon, these managed services often bundle security overhead into the cost of every API call. By decoupling the execution environment from the model provider, an organization moves from a variable cost model to a **fixed infrastructure model** where the only limit is the underlying hardware. The financial burden of managed sandboxes extends beyond simple compute cycles to the networking infrastructure required to keep them secure. In a typical cloud-managed deployment (such as using AWS Bedrock with private networking) the architecture requires a NAT Gateway to allow the agent to reach external APIs while remaining in a private subnet. ![A diagram of a network architecture showing a NAT Gateway inside a private subnet.](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/c07e0386-3f5b-42ef-a261-8e6cfaced53a/agentrun-open-source-sandbox-for-ai-agents-illus-3db2ac64.webp) Regardless of whether the agent is processing a complex reasoning task or sitting idle, this single component incurs a fixed hourly charge. AgentRun’s open-source architecture is compatible with deployment on existing container orchestration platforms, utilizing shared ingress controllers to bypass these individual gateway fees. | Service Model | Primary Overhead Source | Cost Impact | | :--- | :--- | :--- | | Claude Dynamic Sessions | Per-session hourly fee | Direct scaling of costs with agent uptime | | Bedrock Managed Agent | NAT Gateway monthly minimum | Fixed baseline cost even for zero-utilization agents | | AgentRun Self-Hosted | — | — | When a model like GPT-6 Astra generates a recursive script that requires multiple execution loops to debug, a managed provider bills for each initialization and state transition. Under the AgentRun model, those iterations occur within a local or private cloud boundary. This allows developers to implement more aggressive error-correction loops without budget exhaustion. ## What Activepieces does about this Activepieces provides the orchestration layer that connects these secure sandboxes to the rest of the enterprise stack, ensuring that code execution results in actual business outcomes. While AgentRun secures the Python environment, Activepieces manages the triggers, data mapping, and long-term state persistence required to turn a script into a production-grade workflow. By using the Activepieces open-source core (licensed under the MIT License), teams can build complex agentic pipelines where the output of a sandboxed execution is immediately routed to thousands of third-party apps without writing custom glue code. ![A multi-step workflow in Activepieces showing an SEO blog writer agent with its configuration panel open.](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/45df20de-6a61-443f-8752-4a180f39ba9d/how-to-set-up-omnara-self-hosted-from-the-curren-323813a0.webp) In Activepieces, every connector is an agent tool. An integration registered once runs as a flow step and a schema on a per-project MCP server, so models call the same logic structured flows use without a second migration. MoneyGram and FundingSocieties run this to keep agent actions in sync with their automation library, a mechanism checkable in the Integrations Framework and MCP Server documentation within the open source repo. This architecture allows a model to generate code for a specific data transformation in AgentRun and then pass the result to an Activepieces step that updates a CRM or sends a notification. The platform specifically addresses the "zombie task" problem by providing a durable execution engine that wraps the sandbox calls. If an AgentRun instance completes a task but the subsequent network call to a third-party API fails, Activepieces retains the state and allows for automated retries or human-in-the-loop approvals. This ensures that the reliability gained from isolated code execution is not lost during the data transport phase, creating a seamless bridge between the reasoning model, the secure sandbox, and the final system of record. ![A completed flow run showing trigger and step execution with HTTP request details and success status](https://ap-marketing-media.fra1.cdn.digitaloceanspaces.com/uploads/bf7801a3-7dea-4788-a83a-1d3dde0fbc59/what-actually-transfers-when-you-migrate-off-aut-3c5ad478.webp) ## Frequently asked questions about AgentRun implementation? AgentRun functions as a secure execution layer that isolates non-deterministic code generated by AI models from the host system’s primary resources. By utilizing restricted environments, it mitigates the risk of arbitrary code execution vulnerabilities while maintaining the state necessary for multi-step agent logic. ### Is AgentRun compatible with all Python libraries? AgentRun supports any pure Python library and most standard packages, provided they do not require low-level kernel modifications or direct hardware access. Because the code runs in a hardened sandbox, libraries that attempt to manipulate network interfaces or system drivers will trigger a security exception to prevent a compromised agent from pivoting into the broader network. Developers can pre-install specific dependencies like Pandas for data analysis or Requests for API interaction within the environment configuration. This means the agent has immediate access to its toolset without needing to pip install during every execution cycle. ### How does AgentRun handle long-running agent tasks? Long-running tasks are managed through a persistent Orchestrator that monitors worker health and enforces strict execution limits to prevent resource exhaustion. The default configuration ensures that no single agent can hang the system indefinitely, as shown in the following table: | Parameter | Default Value | Consequence for Implementation | | :--- | :--- | :--- | | WorkerPool maxWorkers | — | — | | workerTimeout | — | — | | Server Port | 7340 | Defines the specific entry point for the REST API to interact with the sandbox. | These constraints allow models like GPT-6 Astra or Claude Opus 5.5 to perform deep-reasoning tasks over extended periods without risking a memory leak that crashes the entire infrastructure. If a task exceeds these bounds, the system returns a timeout error, prompting the developer to either optimize the code or increase the resource quota for that specific worker. ### Can I run AgentRun on my own local infrastructure? You can deploy AgentRun on any local server or private cloud that supports Docker, as the entire execution environment is containerized for portability. This self-hosted approach keeps sensitive data within your firewall, which is a requirement for organizations using Gemini 4 Carbon or Grok 4.7 to process proprietary datasets. By hosting the Orchestrator locally, you gain full control over the storage of execution logs and state snapshots. ## Related reading - [Best Open-Source AI Agent Stack Tools in 2026](https://www.activepieces.com/blog/best-open-source-ai-agent-stack-tools-in-2026) - [Jev Ultrafast 2026: Local Browser Agent, Tasks in 7.1s](https://www.activepieces.com/blog/jev-ultrafast-launch-2026-high-speed-local-browser) - [Daytona Pricing 2026: Sandbox Costs and Free Credits](https://www.activepieces.com/blog/daytona-pricing-2026-sandbox-costs-and-free-credits)