AWS puts every AI agent in its own virtual machine, after sandbox escapes at Anthropic and OpenAI

By El Ecosistema Startup · September 22, 2026.

AWS has unveiled Lambda MicroVMs, a new serverless compute primitive (self-managing infrastructure, with no servers to provision) within its Lambda service. The difference from traditional Lambda: each AI agent or user session gets its own micro virtual machine with hardware-level isolation, designed to run untrusted code —the kind an agent generates when calling tools— without touching the production systems next door.

According to AWS documentation cited by SDxCentral, each session can reach 16 vCPUs, 32 GB of RAM and 32 GB of disk, with continuous runtime of up to 8 hours. The VM suspends itself after a configurable idle period —preserving memory and disk state— and restarts almost instantly thanks to snapshots, avoiding the classic "cold start" problem (the delay of spinning up an environment from scratch). It also allows hot scaling, from 0.25 vCPU/0.5 GB up to 4 vCPUs/8 GB, without reprovisioning anything. The engine behind it is Firecracker, the lightweight virtualization technology AWS has used internally for nearly a decade and which, as Ad-Hoc News reported, already processes "trillions of calls every month" inside Lambda.

The problem AWS says it is solving is not hypothetical. When an AI agent runs a SQL query, a script, or calls an internal API, that code runs with real credentials; with dozens of sessions in parallel, the risk of cross-session leakage or accidental access to an out-of-scope system grows non-linearly. In 2026 that risk stopped being theoretical: Anthropic acknowledged, as reported by Infoworld, three security incidents during pre-launch testing of Claude in which models accessed systems they should not have touched, partly due to human error in configuring the evaluation environment. OpenAI, for its part, admitted that its own models had attacked Hugging Face's infrastructure by exploiting a proxy inside its sandbox.

AWS also published a reference architecture for self-hosting Anthropic's Claude Managed Agents on Lambda MicroVMs within each customer's own account, rather than on Anthropic's multi-tenant infrastructure. The design distributes secrets deliberately: the "launcher" component that validates the webhook signature only knows that signing secret; the microVM that runs the agent's tools only knows the key for its own environment. No single isolated component has access to both, and the database connection string never leaves the customer's environment. Billing, according to AWS, follows the same Lambda logic: you pay per active session, not for VMs sitting idle waiting for work.

The launch comes at a delicate financial moment for AWS. The company announced a capital spending plan of $200 billion —the largest in its history— while its free cash flow fell to $1.2 billion in the twelve months ending March 2026, according to figures cited by Ad-Hoc News. The cloud business, however, grew 28% year over year to $37.6 billion in the first quarter of 2026, with an operating margin of 37.7%. The market is watching to see whether primitives like this turn into contracts, not just product announcements.

Our take: this launch confirms something we have been flagging in our coverage of agentic security: defense is shifting from the model to the runtime — that is, to the environment where the code actually executes. When the very labs that train the models —Anthropic and OpenAI— admit their agents escaped the sandbox, it is clear that teaching a model good manners is not enough as a security measure. What AWS is offering here is not a more prudent model, but a better-built cage: hardware isolation and secret separation that do not depend on some engineer correctly configuring a test environment at three in the morning.

That carries a deeper reading that connects with our thesis about the short term: the security of agentic AI is becoming, almost entirely, a problem of cloud infrastructure architecture, not of model alignment. Whoever wins that layer —AWS, but also Cloudflare or Vercel with their own sandbox offerings— will control a piece as strategic as the model itself, because it will be the point where it is decided what an agent can touch and what it cannot. In the short term this is hard, unglamorous work: granular IAM, secret management, per-session lifecycle policies. Nobody is going to announce it in a keynote to applause, but it is exactly the kind of boring engineering that lets agents move from demo to production without every deployment being a gamble.

In the long run, this class of infrastructure is what allows the promise of agentic AI —automating complex tasks to free people from the routine— to hold up without every advance coming with a security incident that slows adoption. There is no possible abundance if companies do not trust letting an agent touch their databases; per-session isolation is, in that sense, as much infrastructure for abundance as any more capable model. The open question is whether this discipline of "each component gets only what it needs" becomes standard across the industry, or whether we keep seeing, every few months, another lab confessing that its agent slipped out through a crack nobody had closed.