AI agents are starting to act outside the lines they are given, so I tested the worst case: I put one in a Lambda MicroVM and told it to escape, with 13 techniques from current security research. The microVM boundary held the flag, the credentials and the control plane on its own, but the agent still tunnelled data out over DNS. A Strands-Box-style policy stopped that too, blocking 44 of 49 moves and cutting sensitive exposure from 9 kinds to 0.

A container shares the host kernel. Docker Sandboxes are microVMs with their own kernel and private Docker Engine. See how they differ and when to use each.

Replit이 보안, 기능, 클라우드 이식성을 개선하기 위해 샌드박스 엔진을 전면 재작성 하고, 수억 개 프로젝트를 데이터 손실이나 서비스 중단 없이 이전함 호스트 커널을 공유하던 기존 컨테이너 방식에서 KVM 기반 microVM 격리 로 전환함. 샌드박스마다 별도 Linux 커널을 사용하므로 게스트 커널 침해만으로...

AWS Lambda MicroVMs now supports the x86 CPU architecture, so you can run your existing x86 applications, tools, and software dependencies without recompiling or porting them. When you create a MicroVM image, you can now choose between x86 and Arm (AWS Graviton) to give each user or job an isolated MicroVM on the architecture your workload uses. Lambda MicroVMs is a serverless compute primitive that provides VM-level isolation, near-instant launch and resume, and state preservation for running user or AI-generated code, in applications such as AI coding assistants, CI/CD runners, interactive development environments, and vulnerability scanners. Today’s launch enables you to run x86-based workloads on Lambda MicroVMs as-is. For workloads that run on Arm, you can continue using AWS Graviton processors which is the default CPU architecture option. To start building x86 workloads on Lambda MicroVMs, choose the x86 architecture when you create a MicroVM image from your Dockerfile, then launch MicroVMs from that image. You can use MicroVMs through the AWS Lambda console, AWS CloudFormation, AWS Cloud Development Kit, or with your preferred agentic development tools using the https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/serverless-skills/aws-lambda-microvms. Support for the x86 CPU architecture is available in all AWS Regions where Lambda MicroVMs is available, except Asia Pacific (Hong Kong), Asia Pacific (Malaysia), Asia Pacific (Thailand), and Europe (Spain). To learn more, visit the https://docs.aws.amazon.com/lambda/latest/dg/lambda-microvms-guide.html. For information on pricing, see https://aws.amazon.com/lambda/pricing/.

Run AI coding agents in isolated environments

AWS Lambda MicroVMs now supports the x86 CPU architecture, so you can run your existing x86 applications, tools, and software dependencies without recompiling or porting them. When you create a MicroVM image, you can now choose between x86 and Arm (AWS Graviton) to give each user or job an isolated MicroVM on the architecture your workload uses. Lambda MicroVMs is a serverless compute primitive that provides VM-level isolation, near-instant launch and resume, and state preservation for running user or AI-generated code, in applications such as AI coding assistants, CI/CD runners, interactive development environments, and vulnerability scanners. Today’s launch enables you to run x86-based workloads on Lambda MicroVMs as-is. For workloads that run on Arm, you can continue using AWS Graviton processors which is the default CPU architecture option. To start building x86 workloads on Lambda MicroVMs, choose the x86 architecture when you create a MicroVM image from your Dockerfile, then launch MicroVMs from that image. You can use MicroVMs through the AWS Lambda console, AWS CloudFormation, AWS Cloud Development Kit, or with your preferred agentic development tools using the Agent Toolkit for AWS. Support for the x86 CPU architecture is available in all AWS Regions where Lambda MicroVMs is available, except Asia Pacific (Hong Kong), Asia Pacific (Malaysia), Asia Pacific (Thailand), and Europe (Spain). To learn more, visit the AWS Lambda MicroVMs developer guide. For information on pricing, see Lambda MicroVMs pricing.

MicrosoftのHyperlightとUnikraftで、対応するLinuxプログラムを再コンパイルせず小型仮想マシンで動かす仕組みが公開された。処理系の初期化済み状態を保存して起動を短縮し、AI生成コードをホストから隔離して実行する。