What Is AgentRun? Secure AI Agent Code Execution
Nov 13, 202616 min read
When a model’s output attempts to access sensitive system files or persist unauthorized changes, AgentRun acts as the barrier.
It is a secure, isolated environment where AI agents execute generated code, much like how Activepieces handles automated workflows, without risking the integrity of the host operating system.
This specialized control plane wraps untrusted Python logic in a protective layer.
How AgentRun isolates AI code execution
Who built AgentRun and why it exists
Parcha AI developed AgentRun to bridge the gap between agentic reasoning and safe action. When a model like Claude Opus 5.5 generates a script to process a local dataset, the developer needs a guarantee that the script stays within its lane.
By building this as an open-source platform, Parcha AI provides durable execution. This allows an agent to retain the state necessary to recover and continue a task after a process restart.
This durability prevents a transient system failure from forcing a complete, billable restart of a long-running research task.
The role of a secure execution environment
Nobody wants a simple logic error or a prompt injection attack to turn into a full system compromise. A secure execution environment prevents exactly that.
In a typical workflow, the agent sends code to the AgentRun Server, which then spawns a dedicated Docker container.
Inside this container sits a Python runtime logically separated from the Host OS. This means the code only sees the specific data allocated to that session.
By using this architecture within an automation flow like Activepieces, teams can verify exactly how code is handled before it touches production infrastructure.
Stable execution is currently supported in self-hosted environments, with AgentRun offered as an open-source, self-hostable platform rather than a managed service. Developers can access the core engine through the public repository, which they deploy themselves for production-grade scaling.
Everything below works on Activepieces' free plan. Start without code or a credit card.
How AgentRun executes untrusted code safely
By passing model-generated logic into a managed Python environment, AgentRun strictly limits the library surface area available to the agent.
This architecture confines execution to a pre-defined runtime rather than the host system's root directory, even if a model like Claude Haiku 5.5 generates a script to scrape a database.
The Python-based execution engine
AgentRun is a durable execution platform that retains the conversation, tool results, and workspace state needed to recover and continue an agent's run.
Because the SDK is built on Python, it allows developers to import specific data-science libraries without exposing the broader operating system to the agent's commands.
To deploy this engine locally, your infrastructure must meet specific baseline requirements:
The environment requires Node.js 24.22.3 or higher and a macOS or Linux operating system.
Once these dependencies are active, the system can begin routing agent outputs into isolated containers.
Isolation through containerized sandboxing
AgentRun utilizes Docker to create a physical barrier between the agent’s workspace and your private network. Each run uses a single container, created on its first tool call, rather than a fresh container for every code block. This means a malicious or poorly written loop can't persist across sessions to corrupt subsequent tasks.
Durable execution means each run resumes from its saved state rather than starting as a clean slate. It prevents the accumulation of "zombie" processes that could otherwise inflate your cloud compute bill.
Durable execution for long-running agent tasks
When managing complex workflows with Claude Opus 5.5, AgentRun maintains session state across multiple turns without compromising the sandbox boundary. The system logs the intermediate variables of a task so the agent can pick up where it left off if a network timeout occurs.
Multi-step reasoning becomes possible through this persistence. The underlying container remains restricted to the specific permissions granted at the start of the job.
Accessing AgentRun through open source or managed hosting
Data sovereignty is best protected by self-hosting AgentRun, because the execution environment remains entirely within your own infrastructure.
This prevents proprietary code or sensitive customer data from ever leaving your controlled VPC.
The installation uses standard containerization tools to ensure the environment is reproducible and isolated from the host system.
To deploy the engine locally, follow this sequence:
- First, clone the repository from GitHub to pull the latest stable source code.
- Second, install the necessary dependencies using npm to prepare the environment.
- Third, run the docker-compose up command to orchestrate the isolated containers.
- Finally, verify the server is active on port 7340 to confirm the API is ready for requests.
You will not find arbitrary code execution risks in these workflows once these steps are complete, even when they are powered by Claude Opus 5.5.
Self-hosting via the GitHub repository
The open-source repository on GitHub is the primary distribution point for teams requiring a transparent, auditable execution layer. Accessing the source directly allows security teams to inspect the sandbox boundaries before deployment. This confirms no hidden telemetry or outbound calls exist.
Because the project uses an open license, a firm can scale their internal instances without incurring the per-run costs associated with third-party compute providers.
The AgentRun Cloud managed platform
Using the managed tier eliminates the overhead of patching the underlying Linux kernels that host the sandboxes.
Developers can then focus entirely on the logic of models like GPT-6 Astra. This service includes built-in monitoring dashboards that track execution time and memory usage, providing the visibility needed to identify runaway loops before they inflate your compute invoice.
API key management and initial setup
Generating a unique API key through the AgentRun dashboard or your self-hosted admin panel is the first step in securing the connection. This key acts as the authorization gate. It restricts code execution to your specific instances of Gemini 4 Carbon.
The key must be provided as a bearer token in your request headers. Failing to rotate these keys periodically leaves your sandbox vulnerable if a client-side environment file is ever compromised.
Pricing models for AgentRun implementations
AgentRun costs are determined by the tradeoff between infrastructure ownership and the operational overhead of managing secure, isolated execution environments.
The open-source core allows for unlimited local deployment, but the specialized resource demands of sandboxing untrusted code usually push high-volume users toward managed tiers to avoid the hidden costs of server maintenance.
AgentRun open-source pricing and limitations
The open-source version of AgentRun includes the underlying container logic without a recurring license fee. A developer can experiment with local tool-calling without an immediate impact on the project budget.
Provisioning your own compute resources, such as an AWS EC2 instance, is required for this self-hosted approach, as noted by Agentrun. This creates a variable infrastructure cost that scales with the number of concurrent agents.
The engineering team must manually handle the rotation of temporary environments because the free tier lacks a managed control plane. This manual oversight often costs more in senior developer hours than automating the process would for a small team.
Usage-based billing for cloud execution
By bundling compute, networking, and security into a predictable monthly fee, the managed cloud service simplifies budgeting. This tier is essential for production deployments using models like Claude Opus 5.5.
Basic local setups cannot reliably provide the session persistence required for complex agentic coding tasks. The following table lists the service levels referenced for different business sizes.
| Tier | Monthly Base Price | Concurrent Sandboxes | Max Session Length |
|---|---|---|---|
| Hobby | — | — | — |
| Pro | — | — | — |
| Enterprise | — | — | — |
Prices and plan limits checked against github.com and agentrun.ai on November 13, 2026.
By selecting a plan based on these limits, an agency can ensure that a sudden spike in client requests doesn't result in a "noisy neighbor" effect. This prevents one agent’s execution from slowing down the rest of the fleet.
Enterprise licensing for high-volume agents
Organizations running hundreds of simultaneous workflows use enterprise agreements where data residency and custom security protocols are non-negotiable. At this level, the cost covers more than just raw compute.
Dedicated infrastructure ensures an agent working on sensitive financial data never shares a kernel with a general-purpose research bot.
Large firms can lock in a flat rate by shifting from usage-based to capacity-based pricing. This prevents a high-performing agent from generating an unpredictable bill at the end of the month.
Easier to see it running than to read about it: set it up free, no card.
AgentRun compared to E2B and existing sandbox tools
Because it executes code within local Docker environments rather than remote micro-vms, AgentRun is a low-latency alternative to cloud-native sandboxes.
While cloud-hosted options like E2B offer high-security isolation for multi-tenant applications, the network round-trip introduces a significant delay that can stall the responsiveness of a reasoning model like GPT-6 Astra.
AgentRun eliminates the external API handshake by keeping execution on the same infrastructure as the agent application. Code-heavy workflows don't feel sluggish to the end user.
The trade-off for this speed is the breadth of the runtime environment and the security boundary.
Comparing security boundaries
E2B provides a hardened Firecracker micro-VM for every session. This prevents even a malicious script from escaping to the host machine.
AgentRun uses standard Docker containers. These are faster to spin up but require more rigorous configuration to prevent side-channel attacks on shared hardware.
Piston focuses on high-concurrency code execution across dozens of languages. It lacks the persistent file system state required for complex data science tasks.
AgentRun performance benchmarks vs standard Python
The following data illustrates the performance gap when running a standard Python script.
This means a developer using Claude Opus 5.5 to iterate on data visualizations can see results in real-time.
Consequently, for internal tools where the security perimeter is already trusted, the local container approach minimizes the overhead costs associated with external compute providers.
Integrating AgentRun into an automated workflow
Any automation platform capable of making outbound web requests can trigger AgentRun as an isolated compute layer.
By decoupling the execution environment from the workflow engine, you ensure that high-reasoning models like Claude Opus 5.5 or GPT-6 Astra can generate and test Python code without risking the integrity of your primary server or exposing sensitive environment variables to the model's output.
Sending requests to the API endpoint
Sending a POST request to the AgentRun API endpoint using a standard web request action is the most direct way to execute code.
This method allows you to pass a raw string of Python code generated by a previous step into a secure, ephemeral container.
The following workflow demonstrates the lifecycle of a secure run where an "Instance Stopped" event triggers an automated cleanup process.
The sandbox initializes, runs the script, and returns the result in the response body once the request is sent.
This immediate feedback loop allows the workflow to move to the next phase only after the code has successfully executed.
The logic that governs these tool calls sits in the open monorepo for the automation engine, where the MIT-licensed core ensures the engine remains transparent.
A developer can match the Flow Execution Engine code against the step-by-step trace in the run-details UI to verify exactly how an agentic decision was routed to the sandbox.
Using AgentRun as a tool in AI steps
To give models a "scratchpad" for data processing, you can configure AgentRun as a tool within the native AI actions provided by your automation builder.
When using a model such as Gemini 3.8 Flash for software engineering tasks, you provide the AgentRun API schema as a tool definition.
Calculations or data structure transformations are handled by the model deciding when it needs them.
It then automatically generates the necessary Python code and sends it to the isolated environment.
This setup prevents the model from hallucinating data transformations, as it must rely on the actual output returned by the Python interpreter.
Every connector registered in the workflow platform, including the AgentRun tool definition, is automatically exposed to the per-project MCP server. This allows an agent to call the sandbox from Claude or Cursor without a second migration or manual export step.
Managing execution outputs in a workflow
A clear distinction between the logs of the execution and the final returned value is required when handling data returned from a sandbox.
AgentRun returns a structured JSON object that separates standard output, errors, and the final result variable.
You should map these specific fields to downstream actions to keep your workflow clean.
The result field captures the final value for use in subsequent database or messaging steps.
The log field is a trail for debugging and auditing in your internal logging system. The error field triggers conditional branches to notify an admin if the generated code fails.
Strengths and limitations of the AgentRun environment
Untrusted code is prevented from accessing the host file system or network by the sandboxed execution layer AgentRun provides.
While it secures the execution path, its utility is currently restricted to specific runtime environments and language sets.
Why developers choose AgentRun for Python tasks
Developers choose AgentRun because it packages a pre-configured Docker environment that eliminates the manual overhead of building custom isolation containers.
The environment includes over two dozen assessed capabilities.
Ready for immediate use without additional installation steps are common data processing libraries.
By using the Apache-2.0 License, the framework allows firms to integrate the tool into proprietary commercial software without incurring the recurring licensing fees associated with closed-source alternatives.
| Strengths | Limitations |
|---|---|
| Apache-2.0 License | — |
| Easy Docker setup | — |
| — | Node 24 requirement |
This balance of open licensing and ready-made containers makes it a viable choice for teams prioritizing rapid deployment over broad language support.
Python is the strict focus here. This focus forces developers to rewrite scripts or use bridges if their primary logic exists in other languages.
Because the environment requires Node 24 to manage the execution lifecycle, teams running older infrastructure must upgrade their underlying systems before deployment is possible.
In environments where the sandbox refreshes frequently, isolating code execution is the only way to prevent a model like Claude Opus 5.5 from accidentally deleting local directories.
Since the sandbox refreshes frequently, any persistent state must be explicitly moved to external storage to avoid data loss between execution cycles.
**In environments where the sandbox refreshes frequently, isolating code execution is the only way to prevent a model like Claude Opus 5.5 from accidentally deleting local directories.
What Activepieces does about this
Activepieces provides the transparent execution engine required to verify how AgentRun handles untrusted code. While AgentRun creates the sandbox, Activepieces acts as the auditable control plane that routes data into it.
Because the Activepieces core is MIT-licensed and open-source, security teams can inspect the entire communication path between the LLM and the AgentRun server. This transparency ensures that sensitive environment variables or API keys are never leaked into the sandbox unless explicitly mapped by the user.
To prevent the "black box" problem of AI execution, Activepieces generates a granular execution trace for every code run.
This allows users to point at a specific failed run in the dashboard and determine if the error was a logic flaw in the AI's code or a resource constraint within the Docker container.
This level of visibility is why companies like Rakuten use Activepieces to maintain oversight across thousands of automated tasks.
The platform also manages the lifecycle of the execution environment to prevent resource exhaustion. By using the "Instance Stopped" trigger and HTTP cleanup steps, Activepieces ensures that AgentRun containers are recycled and tokens are revoked immediately after a task completes.
This automated housekeeping prevents the accumulation of "zombie" processes that AgentRun’s ephemeral architecture is designed to avoid, keeping infrastructure costs predictable even under high-velocity loads from models like GPT-6 Luna.
Finally, Activepieces bridges the gap between isolated execution and production action.
This ensures that the "clean slate" of the sandbox doesn't result in data loss, as the workflow engine handles the persistent storage of results while keeping the execution environment strictly separated from the rest of the stack.
Frequently asked questions about AgentRun
Does AgentRun support GPU acceleration?
Secure CPU-bound logic is the focus of AgentRun. This means it doesn't provide direct access to hardware accelerators for localized model inference.
This architectural choice forces a clean separation between the heavy lifting done by a model like GPT-6 Astra and the discrete data processing scripts the agent writes.
It ensures you aren't paying premium compute rates for basic Python execution.
How long can a single code execution run?
A hard timeout restricts execution to prevent runaway loops from consuming your entire compute budget.
If a task requires long-horizon processing, such as a Claude Opus 5.5 instance refactoring a massive codebase, the work must be broken into smaller, stateless chunks.
This prevents a single hung process from locking up a sandbox and inflating the "active time" metrics on your monthly invoice.
Unauthorized data exfiltration is limited by restricting network access by default to a small allowlist of hosts. If an agent using Gemini 4 Carbon needs to fetch live documentation, you must explicitly whitelist the destination domains.
Every outbound byte is a deliberate, billable action rather than a hidden background sync because of this gatekeeping.
Your hosting tier determines the number of simultaneous environments. Self-hosted instances are limited only by your local hardware capacity.
