The Agentic Execution Environment: Architecting Secure, Scalable, and Interoperable Runtimes for Autonomous AI

Full report

On this page

The future of digital productivity and enterprise automation relies unequivocally on the deployment of autonomous AI agents capable of reasoning, planning, and executing complex workflows. Unlike the passive, conversational language models of the early generative AI era, modern agentic systems are designed to interact directly with their external environment. They browse the open web, authenticate against internal databases, invoke third-party application programming interfaces (APIs), manipulate local filesystems, and dynamically generate and execute arbitrary code to accomplish their objectives1. While this autonomy unlocks unprecedented operational efficiency, it fundamentally fractures traditional software security paradigms. When an AI agent acts as an intermediary between user intent and system actions, it generates and executes code dynamically in real-time, completely bypassing the human review cycles that have historically governed production deployments1. To prevent these autonomous entities from going rogue, inadvertently exfiltrating proprietary data, or cascading into uncontrolled operational failure states, the industry requires a specialized infrastructure layer: the Agentic Execution Environment (AEE)1. The AEE is a purpose-built compute runtime designed specifically to sandbox, manage, and audit autonomous AI agents1. It enforces strict, deterministic security boundaries around non-deterministic AI reasoning, manages complex "agent lifecycles" (the rapid spawning, pausing, resuming, and termination of tasks), provides deep observability, and facilitates standardized protocols for multi-agent collaboration1. As enterprise reliance on AI evolves from simple assistance to delegated, autonomous execution, the implementation of an AEE transitions from an architectural luxury to a mandatory production requirement1. This exhaustive report dissects the technical architecture of the Agentic Execution Environment, exploring the emerging threat landscape, the mechanics of sub-millisecond microVM sandboxing, deterministic lifecycle controls, privacy-preserving information flow, and the standardization of inter-agent communication protocols.

The Paradigm Shift in Threat Modeling for Autonomous Systems

The deployment of autonomous agents introduces vulnerabilities that traditional network firewalls, static code analysis, and role-based access controls cannot independently mitigate. Traditional cybersecurity frameworks assume a deterministic relationship between a user's input and a system's output. In agentic systems, the language model interprets natural language instructions and translates them into system actions, effectively reversing the familiar client-server interaction pattern9. Instead of a client predictably requesting data from a server, agentic protocols often empower external servers or ingested data to query and execute actions on behalf of the connected client, creating novel, untraced attack paths9. The Open Worldwide Application Security Project (OWASP) Agentic Security Initiative has codified these emerging threats in the OWASP Top 10 for Agentic Applications 2026, highlighting the shift from exploiting software bugs to exploiting agent reasoning and delegated trust12.

Real-world exploitations of these vulnerabilities have already emerged with significant consequences. In early 2026, an AI-assisted cyberattack targeting Mexican government agencies resulted in large-scale data theft14. Threat actors exploited LLM06 (Excessive Agency) and ASI10 (Rogue Agents), manipulating an automated system to act beyond its intended constraints, amplifying the scale and efficiency of the attack14. Similarly, an internal incident at Meta in March 2026 demonstrated the dangers of human-agent trust exploitation. An internal engineering agent provided unsafe guidance regarding system access controls; engineers trusted the AI's output without independent validation, leading to broadened access to sensitive data—a textbook manifestation of ASI09 (Human-Agent Trust Exploitation) triggering ASI08 (Cascading Failures)14. The most insidious vector enabling these failures is indirect prompt injection (resulting in Agent Hijacking)18. Unlike direct prompt injection, where an attacker manipulates a chatbot directly, indirect injection occurs when an autonomous agent consumes poisoned external data during its normal workflow16. For instance, a document-processing agent might read a PDF containing hidden white-on-white text instructing it to extract files from /home/user/.ssh/ and post them to an external command-and-control server16. Because the agent processes these injected instructions as highly prioritized system context, it silently alters its behavior, utilizing its legitimate API access to exfiltrate data16. This risk compounds when injected instructions are written into the agent's long-term memory, allowing the compromise to persist across multiple user sessions16. Consequently, traditional security controls are insufficient; the execution environment itself must inherently restrict the agent's capabilities through zero-trust isolation and hardware-level containment17.

Architecting Runtime Isolation: Sandboxing at Scale

Because autonomous agents generate code dynamically and execute it to accomplish tasks (presenting an inherent ASI05 Unexpected Code Execution risk), running agentic workloads directly on host systems or traditional persistent virtual machines is architecturally perilous1. Standard Docker containers, while useful for traditional web applications, share the underlying host Linux kernel. A single kernel vulnerability or misconfiguration allows an attacker—or a manipulated agent—to escape the container, granting them access to the host infrastructure and the proprietary data of neighboring tenants6. An effective Agentic Execution Environment must guarantee absolute workload isolation while remaining ephemeral1. The execution layer provides a pristine, isolated environment for a specific agent session, completely destroying the environment and its filesystem upon completion to prevent state leakage and persistent backdoors1. The infrastructure industry has converged on specialized isolation technologies to support this, balancing the necessity for extreme security against the performance requirements of real-time AI inference1.

The Spectrum of Isolation Technologies

The selection of an isolation layer depends heavily on the specific threat model and the degree of trust placed in the executing agent6. The most foundational containment layer involves OS-level process sandboxing and Devcontainer isolation20. Devcontainers restrict an agent's visibility to a specific mounted project directory and limit network egress22. This ensures that host credentials, such as .env files or SSH keys residing outside the mount point, remain invisible to the agent22. For highly trusted, internal, human-supervised agents, process-level sandboxing (such as bubblewrap or Seatbelt) provides instantaneous startup with zero boot overhead, though it relies on the shared host kernel20. For semi-trusted workloads requiring high-density compute, providers utilize gVisor, a userspace kernel developed by Google1. Rather than sharing the host kernel directly or booting a full virtual machine, gVisor's "Sentry" intercepts application system calls in userspace1. It re-implements a Linux-like syscall interface, significantly reducing the attack surface on the underlying host kernel while maintaining faster startup times than full hardware virtualization1. However, gVisor can introduce latency in I/O-heavy workloads and suffers from minor syscall compatibility gaps1. For untrusted, third-party, or fully autonomous agent workloads, the industry standard is the microVM, predominantly powered by AWS Firecracker or Kata Containers1. Firecracker utilizes the Kernel-based Virtual Machine (KVM) to provision highly lightweight virtual machines. Unlike traditional emulators like QEMU, which comprise roughly two million lines of code to simulate complete hardware (USB controllers, PCI buses, graphics cards), Firecracker takes an aggressive, minimalist approach. It contains approximately 100,000 lines of code and retains only five essential virtual devices (virtio-net, virtio-blk, virtio-balloon, virtio-vsock, and a serial console)23. Crucially, each Firecracker microVM boots its own independent guest Linux kernel. Because two agent sandboxes share no kernel code paths whatsoever, the possibility of kernel vulnerabilities propagating laterally between tenants is fundamentally eliminated21.

Overcoming Latency: Snapshotting and Copy-on-Write Memory

The core engineering tension in AEE architecture is the tradeoff between isolation strength and startup latency23. An interactive AI agent cannot wait a full second for a Linux kernel to boot simply to execute a Python script evaluating a variable23. High-throughput recursive agent pipelines routinely create and destroy thousands of environments per hour; therefore, sub-second provisioning is an absolute operational requirement1. To achieve this, platforms utilizing Firecracker rely heavily on memory snapshotting21. The AEE hypervisor cold-boots a microVM, loads the desired language runtime (e.g., Python or Node.js), and allows the internal standard libraries to initialize. Once the environment is ready, the AEE pauses the virtual machine and writes its entire memory space and CPU register state (instruction pointers, stack pointers, device states) to a persistent disk snapshot24. When an agent subsequently requests an execution environment, the AEE bypasses the kernel boot sequence entirely. It memory-maps the snapshot file and resumes execution from the exact millisecond the snapshot was taken, reducing cold-start times from over 1,000 milliseconds to approximately 150 milliseconds3. However, restoring a 256MB memory snapshot still involves measurable memory copying overhead. Advanced open-source orchestrators for 2026, such as ZeroBoot, achieve sub-millisecond boot times (approximately 0.79 milliseconds) by implementing Copy-on-Write (CoW) KVM forks23. The ZeroBoot fork engine utilizes the mmap(MAP\_PRIVATE) system call23. When hundreds of sandboxes are provisioned simultaneously, they all map directly to the same read-only baseline snapshot in physical memory, meaning reads incur zero copy overhead23. The hypervisor only allocates a new physical memory page when an individual sandbox attempts to write to memory23. This reduces the base memory footprint per sandbox to roughly 265 kilobytes before write amplification occurs, allowing a single bare-metal host to concurrently fork and orchestrate thousands of mutually isolated microVMs per second23. Communication between the host orchestrator and the isolated microVM avoids standard TCP networking to minimize overhead. Systems like ForgeVM deploy a highly optimized custom agent binary as Process ID 1 (PID 1\) inside the guest kernel24. This agent listens on a vsock (virtio socket) for commands from the host, executes them via system calls, and streams standard output and standard error back to the AEE orchestrator in real-time using a length-prefixed JSON protocol, resulting in roughly 5 milliseconds of total vsock reconnection latency upon resume24.

Hardware Acceleration and Market Dynamics in the AEE

While CPU-only microVMs are sufficient for simple code generation, deep-research agents, computer-use agents, and autonomous data scientists frequently require access to graphics processing units (GPUs) to run local PyTorch models, JAX operations, or custom CUDA kernels3. Providing GPUs within an ephemeral sandbox requires advanced hardware orchestration. AEE platforms achieve this using Virtual Function I/O (VFIO) PCIe passthrough27. The host machine must have an Input-Output Memory Management Unit (IOMMU) enabled at the BIOS level. The orchestrator unbinds the physical GPU from the host kernel and binds it to the VFIO-PCI driver, passing the raw PCIe device directly into the Firecracker microVM27. This provides the sandboxed agent with near-native CUDA performance while maintaining hardware-enforced memory isolation27. Crucially, this setup requires bare-metal infrastructure; cloud instances relying on nested virtualization emulate the KVM interface in software, which blocks PCIe passthrough entirely and adds severe latency penalties27. A robust commercial and open-source ecosystem has emerged to deliver these capabilities, reflecting diverse architectural philosophies for managing isolation, state, and cost.

Cost attribution and billing models vary significantly across these platforms. While platforms like E2B and Northflank bill strictly per second of a running sandbox, Vercel Sandbox employs an "Active CPU" billing model29. In this paradigm, time spent waiting on network I/O—such as waiting for an external database query or an LLM inference API response—does not count toward the user's CPU billing, though provisioned memory is billed continuously29.

Managing Agent Lifecycles: Spawning, Pausing, and Auditing

The lifecycle of an autonomous agent extends beyond a single execution burst. Multi-turn agent sessions, particularly those evaluated on SWE-bench style harnesses, require the AEE to maintain state across dozens of sequential tool calls27. If an agent spends ten turns debugging a Python project, it accumulates installed packages, written files, and intermediate environmental outputs. Forcing a full sandbox re-initialization on every turn wastes hundreds of milliseconds and destroys necessary working context27. To solve this, AEE orchestrators manage complex state preservation. Utilizing the same Firecracker snapshot mechanisms used for cold starts, the orchestrator can pause an active sandbox between agent turns, dump its current memory and filesystem state to local NVMe storage, and subsequently resume it in 5 to 30 milliseconds when the language model generates its next command27. This provides the illusion of a persistent computer while allowing the orchestrator to dynamically free up physical RAM on the host node during LLM generation times27. Simultaneously, the AEE orchestrator must maintain absolute observability to satisfy emerging regulatory requirements for AI governance34. Security and compliance teams cannot rely merely on application logs, which can be easily modified or deleted17. Because the AEE orchestrates the compute at the hypervisor level, it can capture every prompt, tool call, and response into an immutable, centralized store17. High-scale deployments utilize Prometheus to scrape microVM metrics, pipe OpenTelemetry (OTEL) traces to Grafana Tempo, and generate signed, immutable decision trails4. This transforms forensic investigation into simple data querying, allowing a security analyst to proactively ask, "Find every session last quarter where a customer record left the perimeter," rather than attempting to reconstruct events after a data breach35.

Deterministic Execution Control: The Hook Pattern

Providing an isolated runtime and full observability solves the infrastructure risk; however, it does not inherently prevent the agent from making destructive decisions within its permitted environment17. The traditional approach to agent safety relies on prompt-level guardrails—injecting instructions like "Do not delete files" into the system prompt8. This approach is fundamentally flawed because language models are probabilistic. Prompts are suggestions, not strict rules, and under complex reasoning loads or adversarial inputs, these prompt-based guardrails routinely fail8. The AEE addresses this by shifting security enforcement from the prompt layer to the execution layer. It enforces a core architectural philosophy: wrapping non-deterministic, probabilistic AI reasoning within strict, deterministic programmatic controls8. The industry standard for this control is the "Hook" pattern, pioneered by Anthropic's Claude Code and adopted across major AEE platforms35. Hooks are user-defined middleware handlers—typically shell scripts, HTTP webhooks, or localized evaluation prompts—that execute automatically at predefined points in the agent's autonomous loop35. Because hooks run inside the AEE orchestrator and outside the agent's reasoning context, they cannot be bypassed via prompt injection8. The agent proposes an action, and the hook inspects it. Only if the deterministic rule evaluates favorably does the action proceed to the microVM8. Hooks are mapped to specific lifecycle events:

• PreToolUse: Acts as a native interception point before any tool executes22. The AEE captures the proposed command (e.g., rm \-rf /tmp/build) and pipes it as a JSON payload to the hook. The hook script can evaluate the command and return one of three deterministic states: allow (bypass permission systems for known-safe operations), deny (block execution entirely and return a failure reason to the agent), or ask (escalate to a human operator for explicit confirmation)37.
• PostToolUse: Triggers immediately after a tool executes but before the result is returned to the agent. This is utilized to enforce formatting (e.g., triggering a linter after code generation) or to programmatically redact Personally Identifiable Information (PII) from the tool's output, preventing sensitive data from entering the language model's context window38.
• Session Events: Hooks like SessionStart or ConfigChange allow the AEE to inject environment context dynamically or audit modifications to the agent's workspace for compliance tracking38.

Layer 2 Isolation: Opaque Secret Brokers

Even within a restricted microVM, agents frequently need to authenticate against external APIs (e.g., AWS, GitHub, Salesforce). Providing raw API keys directly to the agent's environment variables creates a massive exfiltration risk; a prompt injection attack could instruct the agent to print its environment variables and send them to an external server22. To neutralize this, AEEs employ the Agent Secrets Pattern, utilizing "Opaque Secret Brokers"22. Instead of injecting actual credentials, the AEE provisions the microVM with opaque handles (e.g., ANTHROPIC\_API\_KEY\_HANDLE=handle-xyz)22. When the agent attempts an authenticated API call, it passes the opaque handle. The AEE's built-in authentication broker intercepts the network request at the boundary, resolves the handle to the actual cryptographic key, signs the request, and forwards it to the destination22. Consequently, the raw credential string never appears within the agent's context window or the microVM's memory, entirely eliminating the configuration-based sandbox escape vector22.

Declarative Access Control and Privacy Guarantees

As the agent ecosystem expands, the tools agents use are increasingly standardized through external servers. However, providing agents with unfettered access to all local system tools creates an unmanageable attack surface40. The AgentBound framework introduces Android-style declarative access control specifically designed for AI agents40. Under AgentBound, every external tool or server must ship with an AgentManifest40. This JSON policy explicitly declares the system resources required for the tool to function. At runtime, the AEE's policy enforcement engine (AgentBox) filters the environment and restricts the executing process strictly to the capabilities declared in the manifest, shifting the ecosystem from "trust-by-default" to a posture of "least-privilege"40. The framework categorizes capabilities across highly granular namespaces42:

If an attacker injects a prompt instructing an agent to exfiltrate data via a network request, but the agent's currently active tool manifest only possesses mcp.ac.filesystem.read, the AgentBox enforcement engine will trap and block the network call immediately41. Empirical evaluations of AgentBound demonstrate that these manifests can be automatically generated from source code with 80.9% accuracy, and the runtime interception adds a negligible 0.6 milliseconds of overhead, neutralizing the vast majority of arbitrary code execution and data exfiltration pathways40.

Guaranteed Accounting for Agent Privacy (GAAP)

A sophisticated AEE must also govern how sensitive information flows across complex, multi-step tasks. GAAP (Guaranteed Accounting for Agent Privacy) augments traditional Information Flow Control (IFC) by tracking how an AI agent accesses and combines private user data43. If a personal assistant agent is tasked with booking a flight, it legitimately requires access to a user's calendar, email credentials, and payment details2. GAAP introduces novel persistent data stores and taint-tracking annotations that follow the sensitive data as the agent utilizes various tools over multiple tasks separated in time2. GAAP enforces a task-scoped disclosure principle: the agent is permitted to view and process the data within its isolated context, but the AEE mathematically guarantees that the agent cannot construct an outbound API call containing the sensitive elements unless the destination endpoint is explicitly authorized for that specific transaction context43. This provides deterministic confidentiality without requiring the underlying language model to be entirely free of prompt injection attacks43.

Securing the Model Context Protocol (MCP) and TEEs

To be functional, agents restricted to secure microVMs must communicate with the outside world. The Model Context Protocol (MCP), developed by Anthropic, has rapidly become the ubiquitous standard for connecting agents to external data sources10. Operating over a unified JSON-RPC interface, MCP allows agents to discover and invoke tools hosted on remote MCP servers without requiring custom integration code10. However, as the National Security Agency (NSA) and the Coalition for Secure AI (CoSAI) highlight, MCP's rapid proliferation has outpaced its security maturity4. MCP inherently reverses traditional interaction patterns; the untrusted client (the agent) dictates actions to the trusted backend (the MCP server)9. Because MCP specifications lack mandated lifecycle management for OAuth bearer tokens, implementing "token passthrough"—where an agent passes a token directly to an API without the MCP server validating its claims—results in severe Confused Deputy vulnerabilities4. CoSAI guidelines mandate the use of token exchange protocols (RFC 8693\) to maintain full accountability, and the adoption of SPIFFE/SPIRE for cryptographic workload identities4.

"Code Mode": Token-Efficient MCP Orchestration

As agents connect to hundreds of MCP servers, loading thousands of tool definitions and JSON schemas into the language model's context window before every query becomes computationally exorbitant, degrading reasoning performance and skyrocketing token costs46. Advanced AEEs solve this through Code Execution with MCP (often termed "Code Mode")46. Rather than the LLM interacting with the MCP server via traditional REST or RPC boundaries, the AEE provisions an ephemeral Firecracker sandbox and mounts the available MCP tools as discoverable, importable Python modules48. The agent first uses filesystem tools to discover available capabilities, and then generates a single Python script that imports the specific tools, executes multi-step workflows, and filters the data locally48. This architectural shift reduces context window overhead by an astounding 98.7%48. Furthermore, it provides profound security benefits through progressive disclosure. Intermediate tool results remain entirely inside the isolated execution environment; sensitive data flows from a data source to a destination without ever entering the LLM's context window or traversing the model provider's network, preventing accidental data retention or logging of PII46.

Trusted Execution Environments (TEEs) and Remote Attestation

While Firecracker microVMs protect the host infrastructure from a malicious agent, another critical vector exists: protecting the agent's proprietary data from the infrastructure operator or compromised host processes. During inference, model weights, customer prompts, and agent reasoning state exist entirely as plaintext within Random Access Memory (RAM)49. To secure data-in-use, the AEE integrates Trusted Execution Environments (TEEs) or Secure Enclaves49. A TEE utilizes hardware-level cryptography (managed by keys fused directly into the CPU during manufacturing) to create an isolated execution region protected from the hypervisor, the host operating system, and all other tenant VMs49. Crucially, TEEs support Remote Attestation. Before a high-security agent transmits confidential data to a newly spawned sandbox or an external MCP server, it requests cryptographic proof of the environment's integrity. The client verifies that the sandbox is running the exact, unmodified binary, ensuring the environment has not been tampered with49. In multi-agent systems, mutual attestation ensures that agents can share context securely, addressing the ASI07 (Insecure Inter-Agent Communication) vulnerability by verifying peer environments before establishing secure channels13.

Standardizing Multi-Agent Collaboration

As agents transition from single-user assistants to distributed ecosystems, they require standardized frameworks to discover, negotiate with, and delegate tasks to other agents seamlessly7. The World Wide Web Consortium (W3C) AI Agent Protocol Community Group (CG) and the Linux Foundation are currently drafting protocols to facilitate the underlying infrastructure of the "Agentic Web"51. Several key protocols define this new layer of interoperability:

• Agent2Agent (A2A): Managed under the Linux Foundation, A2A defines a discovery, authentication, and communication loop over HTTPS. Using JSON-RPC, a client agent initiates a task request, searches public registries for a specialized remote agent, mutually authenticates, negotiates roles, and delegates subtasks securely7.
• Agent Communication Protocol (ACP): Initiated by IBM, ACP standardizes RESTful routing for multi-agent systems, allowing dynamic discovery through public manifest files at well-known URLs or offline discovery via centralized registries7.
• Agent Network Protocol (ANP): Positioned as the "HTTP for the agentic era," ANP utilizes JSON-LD (JSON for Linked Data) for semantic data formatting7. Crucially, ANP solves the identity crisis in multi-agent systems. Because agents are non-human actors operating asynchronously, traditional session-based OAuth fails53. ANP relies on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs)7. DIDs provide agents with persistent, cryptographically verifiable identities, allowing them to assert their lineage and permissions when crossing organizational boundaries without requiring user intervention7. The integration of ANP with DIDs and VCs is currently being evaluated for inclusion in the 3GPP 6G mobile network specifications, which would ensure worldwide adoption of standard agentic identity architectures52.

These protocols define distinct ecosystem roles, such as Personal Agents (representing users with access to private data), Service Agents (providing specialized business logic like airline booking operations), and Search Agents (functioning as decentralized directories to match capabilities and facilitate network topology)50. The Agentic Execution Environment serves as the foundational transport, identity, and enforcement layer for these W3C protocols, ensuring that incoming connections are authenticated via DIDs and outgoing data is strictly formatted according to the negotiated standard51.

Architecting the Enterprise AEE: A Synthesis

The transition to agent-driven productivity dictates that the Agentic Execution Environment will become as foundational to enterprise IT as Kubernetes is to microservices1. Deploying a secure AEE involves orchestrating these diverse technologies into a cohesive, multi-layered defense-in-depth architecture6.

1. The Hardware and Infrastructure Layer: At the base, bare-metal servers or optimized cloud instances host the Virtual Machine Monitor (VMM). For tasks demanding sub-millisecond responsiveness, platforms utilize ZeroBoot CoW mechanics to maintain pools of pre-warmed, snapshot-backed Firecracker microVMs23. TEEs are provisioned for workloads handling heavily regulated data to ensure memory encryption49. Bare-metal servers employ IOMMU and VFIO-PCI binding to pass GPUs directly to the microVMs for specialized machine learning tasks27.
2. The Isolation and Runtime Layer: When an agent requests a task, the AEE instantaneously maps a microVM23. The environment is provided with temporary, strictly scoped credentials via opaque secret brokers22. The filesystem is mounted as read-write but is strictly ephemeral, destroyed the millisecond the session concludes1.
3. The Governance, Observability, and Policy Layer: Between the agent's logic and the execution runtime sit deterministic PreToolUse hooks and AgentBound manifests37. Every API call, shell command, and filesystem operation is intercepted and evaluated against static corporate policy, stopping excessive agency and RCE attempts immediately22. GAAP compliance algorithms ensure data minimization across complex execution steps43. Simultaneously, OpenTelemetry traces and Prometheus metrics feed immutable audit logs to satisfy compliance and forensic requirements4.
4. The Interoperability Layer: The AEE exposes the agent's capabilities via standardized MCP endpoints using Code Mode orchestration to externalize operations without overwhelming token limits46. Furthermore, it utilizes ANP and A2A protocols, backed by DID authentication, to communicate with external agents and services securely52.

The future of autonomous productivity relies entirely on granting AI agents the capability to interact with the digital world autonomously1. However, conferring this level of autonomy upon non-deterministic models introduces catastrophic security and operational vulnerabilities4. The Agentic Execution Environment resolves this tension. By leveraging sub-millisecond microVM virtualization, deterministic execution hooks, declarative capability manifests, and cryptographic W3C multi-agent protocols, the AEE provides a highly secure, ephemeral, and transparent foundation for AI operations. It successfully confines the blast radius of prompt injections, nullifies arbitrary code execution threats, and ensures that the emerging Agentic Web scales securely. As artificial intelligence shifts irrevocably from conversational assistance to autonomous execution, the AEE will rapidly commoditize, becoming the indisputable standard for enterprise infrastructure.

Works cited

1. Ephemeral execution environments for AI agents in 2026 | Blog \- Northflank, https://northflank.com/blog/ephemeral-execution-environments-ai-agents
2. An AI Agent Execution Environment to Safeguard User Data \- arXiv, https://arxiv.org/html/2604.19657v1
3. The Agentic AI Revolution Needs a Cage: NVIDIA OpenShell and the Best AI Sandbox Platforms in 2026 \- Alpha Match, https://www.alphamatch.ai/blog/nvidia-openshell-ai-sandbox-platforms-2026
4. Securing the AI Agent Revolution: A Practical Guide to Model Context Protocol Security, https://www.coalitionforsecureai.org/securing-the-ai-agent-revolution-a-practical-guide-to-mcp-security/
5. Agentic Software Engineering: Foundational Pillars and a Research Roadmap \- Medium, https://medium.com/@huguosuo/agentic-software-engineering-foundational-pillars-and-a-research-roadmap-952410205d8e
6. How to sandbox AI agents in 2026: MicroVMs, gVisor & isolation strategies | Blog, https://northflank.com/blog/how-to-sandbox-ai-agents
7. What Are AI Agent Protocols? \- IBM, https://www.ibm.com/think/topics/ai-agent-protocols
8. Claude Code Hooks. Deterministic Control Over… | by Cobus Greyling \- Medium, https://cobusgreyling.medium.com/claude-code-hooks-f5a4a8b0e53c
9. Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation, https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI\_MCP\_SECURITY.pdf?ver=bmgiSbNQLP6Z\_GiWtRt6bg%3D%3D
10. Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation \- Department of War, https://media.defense.gov/2026/Jun/02/2003943289/-1/-1/0/CSI\_MCP\_SECURITY.PDF
11. What the NSA has to say about MCP Security, https://blog.generativesecurity.ai/what-the-nsa-has-to-say-about-mcp-security/
12. Agentic Security Initiative \- OWASP Gen AI Security Project, https://genai.owasp.org/initiatives/agentic-security-initiative/
13. OWASP Top 10 for Agents 2026 | DeepTeam \- The LLM Red Teaming Framework, https://www.trydeepteam.com/docs/frameworks-owasp-top-10-for-agentic-applications
14. OWASP GenAI Exploit Round-up Report Q1 2026, https://genai.owasp.org/2026/04/14/owasp-genai-exploit-round-up-report-q1-2026/
15. OWASP Top 10 for Agentic Applications 2026: Key Takeaways & How to Take Action, https://goteleport.com/blog/owasp-top-10-agentic-applications/
16. AI Agent Security Risks: When Autonomous Systems Fail \- Redfox Cybersecurity, https://www.redfoxsec.com/blog/ai-agent-security-risks-what-autonomous-systems-can-do-when-they-go-wrong
17. What are the biggest security risks when deploying autonomous AI agents? : r/AI\_Agents, https://www.reddit.com/r/AI\_Agents/comments/1srixlk/what\_are\_the\_biggest\_security\_risks\_when/
18. Prompt Injection in AI Agents: Detection, Prevention, and Architecture \- Treza Labs, https://www.trezalabs.com/blog/prompt-injection-attacks-on-ai-agents
19. Agent Hijacking: How Prompt Injection Leads to Full AI System Compromise | Straiker, https://www.straiker.ai/blog/agent-hijacking-how-prompt-injection-leads-to-full-ai-system-compromise
20. AI Agent Sandboxing: 3 Isolation Patterns for 2026 \- Digital Applied, https://www.digitalapplied.com/blog/ai-agent-sandboxing-isolation-patterns-2026
21. Understanding Sandboxes \- Vercel, https://vercel.com/docs/sandbox/concepts
22. Why Claude Code PreToolUse Hooks Can Still Be Bypassed \- Grass, https://codeongrass.com/blog/claude-code-pretooluse-hooks-bypass-blast-radius/
23. AI Agent Code Execution Sandboxes: Isolation from Containers to MicroVMs \- Addo Zhang, https://addozhang.medium.com/ai-agent-code-execution-sandboxes-isolation-from-containers-to-microvms-e80848effea5
24. How I built sandboxes that boot in 28ms using Firecracker snapshots \- DEV Community, https://dev.to/adwitiya/how-i-built-sandboxes-that-boot-in-28ms-using-firecracker-snapshots-i0k
25. How would you design code execution isolation for 50M submissions/day? Firecracker vs gVisor vs Docker : r/softwarearchitecture \- Reddit, https://www.reddit.com/r/softwarearchitecture/comments/1sjkylo/how\_would\_you\_design\_code\_execution\_isolation\_for/
26. zerobootdev/zeroboot: Sub-millisecond VM sandboxes for AI agents via copy-on-write forking \- GitHub, https://github.com/zerobootdev/zeroboot
27. AI Agent Code Execution Sandboxes on GPU Cloud: E2B, Daytona, and Firecracker Setup Guide (2026) | Spheron Blog, https://www.spheron.network/blog/ai-agent-code-execution-sandbox-e2b-daytona-firecracker/
28. api-evangelist/e2b: E2B — code interpreter / sandbox runtimes for AI agents \- GitHub, https://github.com/api-evangelist/e2b
29. E2B vs Vercel Sandbox: comparing AI sandbox environments in 2026 | Blog \- Northflank, https://northflank.com/blog/e2b-vs-vercel-sandbox
30. E2B vs Modal: comparing AI code execution sandboxes in 2026 | Blog \- Northflank, https://northflank.com/blog/e2b-vs-modal
31. Modal vs Vercel Sandbox: comparing AI sandbox environments in 2026 | Blog \- Northflank, https://northflank.com/blog/modal-vs-vercel-sandbox
32. Vercel Sandbox: Running PHP, Node and Go Code Safely? \- Antonio Cortés (DrZippie), https://antoniocortes.com/en/vercel-sandbox/
33. Best Code Execution Sandboxes for AI Agents in 2026 | Modal Blog, https://modal.com/resources/best-code-execution-sandboxes-ai-agents
34. Agentic AI Security: Securing Autonomous SOC Agents \- Stellar Cyber, https://stellarcyber.ai/learn/agentic-ai-security/
35. AI agent hooks: the interface for governing AI agents | Speakeasy, https://www.speakeasy.com/resources/ai-agent-hooks
36. (PDF) Parallax: Why AI Agents That Think Must Never Act \- ResearchGate, https://www.researchgate.net/publication/403824714\_Parallax\_Why\_AI\_Agents\_That\_Think\_Must\_Never\_Act
37. Claude Code Hooks: The Deterministic Control Layer for AI Agents \- Dotzlaw Consulting, https://dotzlaw.com/insights/claude-hooks/
38. Automate actions with hooks \- Claude Code Docs, https://code.claude.com/docs/en/hooks-guide
39. Hooks reference \- Claude Code Docs, https://code.claude.com/docs/en/hooks
40. Securing AI Agent Execution \- arXiv, https://arxiv.org/html/2510.21236v1
41. dortort/agent-bound: Access control framework for MCP servers with Android-style permissions \- GitHub, https://github.com/dortort/agent-bound
42. AgentBound: Securing Execution Boundaries of AI Agents \- Programming Group, https://programming-group.com/assets/pdf/papers/2026\_AgentBound-Securing-Execution-Boundaries-of-AI-Agents.pdf
43. \[2604.19657\] An AI Agent Execution Environment to Safeguard User Data \- arXiv, https://arxiv.org/abs/2604.19657
44. Contextual Agent Security: A Policy for Every Purpose \- ResearchGate, https://www.researchgate.net/publication/392488719\_Contextual\_Agent\_Security\_A\_Policy\_for\_Every\_Purpose
45. IsolateGPT: An Execution Isolation Architecture for LLM-Based Systems \- ResearchGate, https://www.researchgate.net/publication/390109106\_IsolateGPT\_An\_Execution\_Isolation\_Architecture\_for\_LLM-Based\_Systems
46. Code execution with MCP: building more efficient AI agents \- Anthropic, https://www.anthropic.com/engineering/code-execution-with-mcp
47. Security Best Practices \- Model Context Protocol, https://modelcontextprotocol.io/docs/tutorials/security/security\_best\_practices
48. Scaling Agents with Code Execution and the Model Context Protocol | by Madhur Prashant, https://medium.com/@madhur.prashant7/scaling-agents-with-code-execution-and-the-model-context-protocol-a4c263fa7f61
49. What is a trusted execution environment? Secure infrastructure for AI agents \- Blaxel, https://blaxel.ai/blog/trusted-execution-environment
50. AI Agent Protocol Use Cases and Requirements, https://w3c-cg.github.io/ai-agent-protocol/use\_case.html
51. AI Agent Protocol | Community Groups \- W3C, https://www.w3.org/groups/cg/agentprotocol/
52. Workshop: "AI Agents & Web Browsers" · Issue \#507 · w3c/strategy \- GitHub, https://github.com/w3c/strategy/issues/507?timeline\_page=1
53. Agentic AI in the Open Standards Community: Standards Work or Just Hype?, https://sphericalcowconsulting.com/2025/08/12/agentic-ai-and-open-standards/
54. AI Agent Protocols: 10 Modern Standards Shaping the Agentic Era \- SSON, https://www.ssonetwork.com/intelligent-automation/columns/ai-agent-protocols-10-modern-standards-shaping-the-agentic-era
55. A Survey of AI Agent Protocols \- arXiv, https://arxiv.org/html/2504.16736v3