# What Is an Agent VM? The Cloud Computers AI Agents Work In

> An agent VM gives an AI agent an isolated computer for files, code and browsing. Learn how these environments start, pause and store work.

Published 2026-10-14 · Agentastic Team · Canonical: https://www.agentastic.com/learn/what-is-an-agent-vm

**Short answer:** an agent VM is a computer of the agent's own. It's a virtual machine, almost always a lightweight *microVM*, with its own operating system kernel, files, processes, browser and network. The agent can install packages, run code and use websites inside it without touching your laptop or anyone else's machine. When the job is done, the VM is thrown away, or paused so the agent can pick up where it left off.

When OpenAI launched Dots on September 29, 2026, the pitch was that each one has "their own cloud computer" and can work toward your goals around the clock. That phrase, "their own computer," is what an agent VM is.

## Why an AI agent needs its own computer

Ask an agent to "pull last quarter's numbers from these three PDFs, chart them and email me the result," and watch what it needs:

- A place to **run code**, to parse PDFs and draw a chart
- The ability to **install software**, like a PDF library it doesn't have yet
- A **browser**, to download a file from a site that has no API
- **Time**, because the job might take twenty minutes and your laptop might close in five

You could let the agent do all of that on your own computer. For some tasks that's exactly right, because your files and logged-in apps are there. But it means an agent that runs code it just wrote, from instructions it may have picked up from a web page, on the machine that holds your whole life.

An agent VM gives it a clean, separate machine instead. Mistakes stay there. So does anything malicious it downloads.

## How an agent VM works

### A hypervisor and a tiny VM monitor

Underneath is hardware virtualization, usually Linux's KVM. On top sits a *virtual machine monitor* that creates and runs each VM. Traditional monitors emulate a whole PC: graphics, USB, sound, dozens of devices. MicroVM monitors strip that down to the minimum a server workload needs.

**Firecracker**, the open-source monitor AWS built for Lambda, is the best-known example. Its own documentation lists five emulated devices, a boot time under 125 milliseconds, less than 5 MiB of memory overhead per VM, and up to 150 new microVMs per second on a single host. That combination is why it became the default foundation for agent sandboxes. E2B and Vercel Sandbox both run each sandbox as a Firecracker microVM.

### A template image

Each VM boots from a prepared root filesystem: an operating system plus common tools like Python, Node.js, git and a headless browser. Providers let you build your own template, so an agent starts with exactly the libraries a task needs.

### Snapshots and pause/resume

The clever part is snapshots. A VM's memory and disk can be saved and later restored, often faster than booting fresh. That lets a provider keep a pool of warm VMs ready, and it lets an agent **pause** a long task, free the hardware, and **resume** hours later with its files and even its running processes intact.

### A network you control

A VM is only as contained as its network. By default an agent VM should reach only what the task needs. The sandbox escapes of September 2026 were both network failures, not VM failures, which we unpack in [what is an AI agent sandbox](https://www.agentastic.com/learn/what-is-an-ai-agent-sandbox).

### A life cycle

A typical run looks like this:

1. **Create** a VM from a template, in milliseconds.
2. **Hand it to the agent**, which runs commands, writes files and browses.
3. **Collect results**: files, screenshots, a summary.
4. **Pause or destroy** the VM. Paused VMs cost storage. Destroyed ones cost nothing.

## Agent VM vs container vs your own computer

| | Your own computer | Container | Agent VM (microVM) |
|---|---|---|---|
| **Has your files and logins** | Yes | Only what you mount | Only what you upload |
| **Isolation from your machine** | None | Shares a kernel | Separate kernel behind a hypervisor |
| **Safe for untrusted code** | No | Somewhat | Yes, with egress controls |
| **Keeps working when your laptop is closed** | No | If it runs in the cloud | Yes |
| **Startup** | Already on | Well under a second | Firecracker: under 125 ms |
| **GPU** | Yes | Yes | Usually not on Firecracker |

The trade-off is context versus containment. Your own computer has everything the agent might need and nothing protecting it. An agent VM is protected and starts empty. For a deeper technical comparison, see [microVM vs container vs gVisor](https://www.agentastic.com/compare/microvm-vs-container-vs-gvisor).

## Who runs agent VMs in 2026

Agent computers went from a developer niche to a consumer feature this year.

- **Developer sandboxes.** E2B and Vercel Sandbox (Firecracker microVMs), Modal (gVisor, with full VMs as an option) and Daytona are the common building blocks other agents run on.
- **Consumer agents with a computer.** OpenAI's Dots each get their own cloud computer. ChatGPT Work uses a cloud browser.
- **Coding agents.** In September 2026 OpenAI gave Codex reusable cloud environments that follow you across devices.
- **Open-source agents.** Hermes Agent can run its commands on seven backends, from your local machine to Docker, SSH, Singularity, Modal, Daytona and Vercel Sandbox, and the Modal and Daytona options hibernate when idle.
- **Local alternatives.** Perplexity went the other way with Portable Computer in August 2026, running its agent entirely on local NVIDIA hardware rather than in the cloud.

## What agent VMs cost, and their limits

Agent VMs are usually billed by the second for CPU and memory, plus storage for anything kept. Short tasks are cheap. Agents that sit idle with a VM running are not, which is why pause and hibernate features matter.

A few limits to know:

- **Limited GPU support.** Firecracker was designed without GPU passthrough, so work that needs a GPU usually runs in containers, gVisor or full VMs.
- **Empty by default.** The agent only has what you give it. Uploading files and connecting accounts is part of the task.
- **Persistence varies.** Some providers delete everything at the end. Others keep paused VMs for days. Know which you're using before an agent saves something important there.
- **Isolation isn't access control.** A VM protects your computer from the agent. It doesn't stop the agent misusing credentials you put inside it. Keep secrets in a vault, not in the VM. See [what is an agent vault](https://www.agentastic.com/learn/what-is-an-agent-vault).

## Should your agent use a VM or your computer?

Use **your own computer** when the task depends on your local files, your logged-in desktop apps, or watching you work. Use an **agent VM** when the task runs code, installs things, browses unfamiliar sites, takes a long time, or should continue after you close the lid.

The best personal agents do both and pick per task.

## How Agentastic uses both

Agentastic's co-working agents run on your Mac, inside the apps you're using, because that's where your context is. They work with the permissions you grant macOS and ask before anything that commits you.

When you hand work to your agent from iMessage or the web, it doesn't need your Mac to be awake. Code runs in isolated sandboxes and browsing happens in isolated cloud browsers, kept separate from the servers that hold your account. The same agent and the same memory connect the two, so a task can start in a text thread and finish at your desk.

## Sources

- [Firecracker](https://firecracker-microvm.github.io/) and [Firecracker on GitHub](https://github.com/firecracker-microvm/firecracker)
- [Vercel Sandbox documentation](https://vercel.com/docs/vercel-sandbox), [Modal Sandboxes documentation](https://modal.com/docs/guide/sandboxes), [E2B documentation](https://e2b.dev/docs)
- NTD, [OpenAI Launches Dots, Joins Personal Agent Race](https://www.ntd.com/openai-launches-dots-joins-personal-agent-race_1175920.html) (Sept. 30, 2026)
- TechCrunch, [OpenAI gives Codex reusable cloud environments that work across devices](https://techcrunch.com/2026/09/29/openai-gives-codex-reusable-cloud-environments-that-work-across-devices/) (Sept. 29, 2026)
- [Hermes Agent on GitHub](https://github.com/NousResearch/hermes-agent), accessed Oct. 11, 2026
- heise online, [Perplexity brings AI agent with "Portable Computer" to local Nvidia hardware](https://www.heise.de/en/news/Perplexity-brings-AI-agent-with-Portable-Computer-to-local-Nvidia-hardware-11426452.html) (Aug. 26, 2026)

## Frequently asked questions

### What is an agent VM?

An agent VM is a virtual machine dedicated to an AI agent. It gives the agent its own operating system kernel, filesystem, processes, browser and network so it can install software, run code and use websites without touching your computer or anyone else's. Most agent VMs are microVMs that start in well under a second and are discarded or paused after the task.

### Is a microVM a real virtual machine?

Yes. A microVM uses the same hardware virtualization as a full virtual machine, so each one runs its own kernel and is isolated from the host by the hypervisor. It is 'micro' because the virtual machine monitor emulates only a handful of devices, which makes it start in milliseconds and use only a few megabytes of overhead.

### Why not just run AI agents in Docker containers?

Containers share the host's kernel, so a kernel exploit in agent-written code can reach the host and other tenants. For trusted tools a hardened container is often fine. For running untrusted or agent-generated code on shared infrastructure, a microVM or gVisor gives a much stronger boundary at a small cost.

### How fast do agent VMs start?

Fast enough not to notice. Firecracker, the microVM monitor behind AWS Lambda and many agent sandboxes, boots a microVM in under 125 milliseconds and can create up to 150 per second on one host. Restoring from a snapshot lets an agent resume a paused machine with its files and running state intact.

### Do agent VMs keep my files?

It depends on the provider. Many agent VMs are disposable and are destroyed after the task. Others support pausing, snapshots or persistent volumes so an agent can come back to the same environment later. Check what is kept, for how long, and who can access it.