📺 Today’s recommended deep-dive video: https://www.youtube.com/watch?v=kMXJrzAa5fM

Agents Need Their Own Computers: Inside the Sandbox Revolution with Daytona’s Ivan Borodin

AI agents are evolving from conversational chatbots into autonomous digital employees that can manage bank accounts and write production code. Ivan Borodin, CEO of Daytona, argues that for these “digital knowledge workers” to be effective, every agent requires its own dedicated, secure, and stateful computer—the sandbox.

Core Question: Why is specialized sandbox infrastructure the missing link in turning LLMs into productive autonomous agents?

Highlights

• Why agents need a “digital identity” including their own phone numbers and bank access.
• The critical technical shift from stateless app deployment to stateful, long-running agent environments.
• Why Daytona ditched Kubernetes to build a custom scheduler capable of 60ms startup times.
• The looming global CPU shortage driven by massive reinforcement learning (RL) and agentic workloads.

⏱️ Reading time: approx. 9 minutes · Saves you about 56 minutes vs. watching.

Want to take notes while watching? Click the image below and let AI Notebook capture the key points for you 👇

The Anatomy of an AI Sandbox

Defining the Digital Knowledge Worker

An AI agent is essentially a digital knowledge worker. Just as a human employee cannot be productive without a laptop, an agent requires a computational environment to install tools, browse the web, and execute scripts. This environment is what we call a “sandbox.” It provides the isolation necessary for security while giving the agent the “hands” it needs to interact with the world.

The “Open Claude” Mac Mini setup is the perfect analogy for this concept. In this setup, the LLM is the brain, and the Mac Mini serves as the sandbox—a physical or virtual machine where the agent lives. Borodin notes that when he tasked an agent with fetching bank data, it asked for his login credentials. This “broke the thesis” of security for him. Instead of giving an agent access to a personal machine, it should have its own account, its own phone number for 2FA, and its own isolated sandbox where it can only access specific data without the risk of spending money or leaking sensitive files.

The fundamental shift here is from statelessness to statefulness. Legacy cloud providers like AWS or eBay’s infrastructure were built for deploying apps that shouldn’t change on the fly. In contrast, an agent’s computer must be stateful; it needs to remember what it did ten seconds ago and maintain that environment over long periods.

💡 Digging Deeper

Q: Why can’t we just run agents on our local laptops?
A: Reliability and concurrency. If you close your laptop, the agent terminates. Furthermore, a single laptop cannot handle the compute required to run 100 or 1,000 agents simultaneously.

Q: Is a sandbox just a fancy name for a Virtual Machine (VM)?
A: It starts with isolation, but a true sandbox is a “composable computer.” It includes the infrastructure to spin up in milliseconds, the primitive (VM or container), and the specific tooling for agentic guardrails.

Q: Does every agent need a sandbox?
A: Most do. If an agent is just providing emotional support or basic chat, it doesn’t need a computer. But for financial services, healthcare, or coding, a sandbox is mandatory.

Building Infrastructure for Infinite Scale

The Race for Sub-Second Latency

Speed is the ultimate ergonomic requirement for agent consumption. Daytona can initialize a sandbox in roughly 60 milliseconds and spin up 50,000 instances in 70 seconds. This isn’t just about user experience; it’s a hard requirement for reinforcement learning (RL). In RL environments, researchers need to maximize GPU utilization. If a CPU-based sandbox takes 10 seconds to start, the expensive GPU sits idle, wasting thousands of dollars per hour.

Daytona had to throw out the standard industry playbook to achieve these speeds. Most competitors use off-the-shelf schedulers like Kubernetes or Nomad, but these were designed for web apps, not stateful agent workloads. Borodin’s team wrote their own scheduler from scratch. This custom architecture allows them to “lazy load” memory and perform point-in-time snapshots, enabling an agent to branch its logic or roll back if it makes a mistake.

The scheduler acts as the brain of the data center, cutting up massive bare-metal servers into tiny, agile machines.

💡 Digging Deeper

Q: What is the difference between ephemeral and long-running sandboxes?
A: Ephemeral sandboxes die as soon as a task is done, which is great for security. Long-running sandboxes can stay active for weeks, allowing an agent to act as a persistent employee.

Q: Why are “Snapshots” and “Forks” so important for agents?
A: They allow “speculative execution.” An agent can take a snapshot of its current state, try two different coding solutions in parallel “forks,” and keep the one that passes the tests.

Q: How does Daytona handle the hardware layer?
A: They use co-location providers and bare-metal machines. Their scheduler can attach to any CPU server globally and turn it into part of their “Neo-Cloud” for agents.

The New Agent Stack and the Coming Hardware Crisis

Beyond the Model: Memory and Identity

The agent stack is maturing into a multi-layered architecture. While the LLM is the “brain,” we still lack a perfect “memory” solution. Currently, the most elegant approach is dumping context into Markdown files. This simple, text-based method allows agents to compress and retrieve data efficiently, though Borodin admits it feels less robust than a traditional database.

There is also the problem of “learning.” Current models don’t actually get smarter while on the job. If an agent messes up a task on Monday, it will likely mess it up again on Tuesday unless the human provides more context or a better prompt. Solving this requires a tighter loop between the sandbox execution data and model post-training, creating a system that evolves with the user.

However, the biggest hurdle might not be software, but silicon.

While the world is obsessed with the GPU shortage, a CPU crisis is looming. As agents proliferate, the demand for “worker” CPUs to feed the “thinker” GPUs is skyrocketing. Borodin predicts that by late 2024, the industry may hit a wall where there simply aren’t enough CPU-based sandboxes to support the massive scale of autonomous agent fleets.

💡 Digging Deeper

Q: What is the “Agent SDK” announced by OpenAI and Anthropic?
A: These are “harnesses.” They help guide the model on how to use tools and memory. Some are managed (Anthropic), while others are open frameworks you can run in your own sandbox (OpenAI).

Q: Will models eventually replace the need for sandboxes?
A: Unlikely. Even if models get more efficient, the need for a secure “walled garden” where code can be safely executed will always exist in an enterprise environment.

Q: How should founders think about distribution in this space?
A: Borodin argues for a “Human-Centric” approach. Even for deep tech, things like rapid customer support and high-quality branding (the “vibe” of the product) are what drive developer preference.

Key Takeaways

The transition from chatbots to autonomous agents marks a fundamental shift in cloud architecture. We are moving away from the “serverless” era of the last decade toward a “stateful sandbox” era. Every digital worker needs a home—a place where its files, identity, and processes can persist without the limitations of a local laptop or the security risks of a shared environment.

For technical founders, the lesson is clear: infrastructure is the differentiator. While models are becoming commoditized, the ability to spin up millions of secure, high-performance execution environments is where the real value lies. Speed, security, and “ergonomics” are the three pillars that will define the winners of the agentic supercycle.

Finally, we must prepare for a hardware landscape that is increasingly constrained. As reinforcement learning becomes the primary driver of model intelligence, the demand for CPU-heavy simulation environments will rival the demand for GPUs. The “boring” parts of the data center—the CPUs and the RAM—are about to become the most valuable real estate in the AI economy.

Q&A

Q1: What is the simplest way to explain a sandbox to a non-technical person?
A: It is a “Mac Mini in the cloud” for your AI. It’s a separate computer that you give to your agent so it doesn’t have to use yours, keeping your personal files safe while giving the agent a place to work.

Q2: Why did Daytona choose to use “Sysbox” for containers?
A: Containers are faster and more dense than VMs, but they are less secure. Sysbox provides “VM-like” isolation for containers, allowing Daytona to offer the speed of Docker with the security required for enterprise agents.

Q3: How does Ivan Borodin view the “supercycle” of AI?
A: He believes we are in a rare window of massive technological shift. If you “pause” or take a break during this cycle, you are effectively seeding your market share to competitors who are working through the holidays.

Q4: Can sandboxes run operating systems other than Linux?
A: Yes. While many use Firecracker (Linux only), Daytona supports QEMU, which allows agents to run in Windows, Mac, or even Android environments, which is necessary for legacy enterprise apps.

Q5: What is Ivan’s “Golden Rule” for customer support?
A: Speed of the first response is everything. Even if you don’t have the answer, acknowledging the problem immediately calms the customer and transfers the “burden” of the problem to the provider.

Q6: What is the “Identity” problem for agents?
A: Agents need more than just an API key; they need a persona that can pass 2FA, have a credit card with spending limits, and be recognized as a distinct “employee” by banking and SaaS platforms.

Q7: Is the current Transformer architecture the “end state” for AI?
A: Borodin is skeptical. He believes new model types—perhaps ones that require less compute or mimic biological brains more closely—could eventually disrupt the current GPU-heavy paradigm.