hahaha, I suppose it is becoming a bit like hunger games, haha.
I was genuinely surprised to see how much overlap there was in the batch across startups.
Similar to Sprites in capability, so if you can use sprites you can use agent37. We're also about 94% lower cost than them.
Fly certainly has great branding since they've been around for a while now. So they have a distribution advantage. But I think at some point they will also need to own some niche rather than just being a generic sandbox company, given how competitive the space is.
I have been using your service for a few months… super easy to set up and use. I signed up after my bank would not let me process a payment to Hetzner :)
My use case was to play around with hermes. I was using it for a while but I didn’t like how it ended up (the whole set up became overran with files and was a mess, my fault).
I still haven’t 100% figured out how I may want to use the service again, but I thought it was super easy to set up.
My only feedback is that some connectors for google’s integration were kind of privacy nightmare the last time I checked.
Google’s API for using AI has abominable UI and set up.
It would be nice to be able to bridge the gap of simplifying Google’s AI/Service integration while not having to hand over access to every Google service I use.
For connectors we do offer managed MCPs like Composio, BraveSearch, and even an LLM gateway (which routes to openrouter). So what we have is simply a pass through for now and we're not looking to do more there. Since most of our early customers were just launching personal agents like Hermes, OpenClaw, Claude Code and wanted an easy white label setup.
Although now it's expanded to just sandbox usecases.
Yeah, this seems like a niche where multiple startups are coming in. But if I remember correctly, we're about 3X cheaper than boat. We did a detailed comparison of all sandbox companies and where we stand across vendors here
This is cool; pricing is certainly appealing. At the same time, there are a tons of sandboxing providers.
> When you look at agent harnesses, ... CPU/RAM utilization we could lower the cost.
How does it work today? Is the harness (assuming it means the agentic loop) located in a separate VM and each loop run invokes a separate sandboxing VM?
That's right each harness runs in it's own sandbox. Really the harness itself is just a docker template with some pre-installed harness (say openclaw, hermes, claude code, opencode, pi, grok etc) that runs.
Think of it as open router for Agent harnesses. So in our default templates we also run this and expose the APIs. So that makes using any harness easy as they all speak a single OpenAI responses API schema.
I've been looking at offloading local work from my MacBook Pro (M1 Pro / 32 GB) specifically because I've been working with a lot of Android apps and emulation is killing me on top of everything else that I'm running.
Got a bunch of Daytona credits which are close to useless given their restrictions until you hit tier 3.
You seem like you're actually slightly cheaper than https://boat.dev/ but with less storage? That's the closest to your pricing unless I'm mistaken. Any other insight as to differences between you two?
Also I'll add you to a list I've been maintaining of sandbox providers, congrats on the launch!
You guys are operating in a very competitive space. This stuff is fun to build, so a lot of engineers will end up building it. Not to discourage you, but I suspect it will be difficult to capture much value selling this offering as its going to be race to the bottom against very well funded alternatives that can sell these features at a loss in order to get you to use their databases and other offerings that are higher margin and stickier.
As you guys learn more about how to take this sort of technology to market, you may consider trying to get closer to the actual work that people actually need these agents to do. What can you do better because you have this technology? For example, I work in healthcare administration and we have built our own agent sandbox infrastructure on top of firecracker microvms that solve similar use cases as Agent37. We will never sell it. It's part of our competitive advantage for doing healthcare tasks.
Thank you !
And agreed, it's an extremely competitive space. In our YC batch alone there's probably 5+ companies doing something similar. Interestingly enough though atleast for now we're all rapidly growing, so that's promising.
But eventually I see us all moving in slightly different spaces as we specialize.
Great to hear you are growing! Take this as you might grains of salt.
The promise of really cheap AI sounds amazing and is amazing. People will happily accept and engage with "free stuff"; but, I presume you are not starting a business to give away free stuff. Unless you have some model that let's you capture value some other way. e.g. Meta just gave everyone a small computer for free with Muse. Or have some sustainable price advantage on the underlying compute e.g. you are nvidia and make it yourself at scale.
I think you deserve to be compensated for your work! It's hard to make a sustainable business when selling something that costs $5 a month to developers (just seeing your calculator). There aren't that many of us, and AWS/GCP/Azure/Cloudflare have our credit cards already. If it were me, I'd be trying to figure out how to charge more and sell the value of the work you are enabling your customers to accomplish, not the cost of the underlying electrons.
Pretty cool, trying it out. What LLM is it using in the free tier? I was surprised that it worked without supplying an API key. The model doesn't seem to know either: "This run is labeled agent37/default. That’s the configured model name I can see; it doesn’t reveal which underlying model/provider it maps to.".
Sandboxes look a bit commoditized. You cannot 10x on basically what's just a VM with a few agent-friendly features in 2026. Hence competing on purely price as a new startup is a bad idea imo. As you mentioned hyperscalers have insane margins, but if this turns out to be a real market, they will lower cost, even just eat the loss if they want and take you out of business. Without any hardware innovation, it's tough for me to see this working. If you are going with a customization angle, again, no moat and plenty of competitors
There's a talk from Travis Kalanick recently on a podcast about this. It talks about the advantages of a startup vs an incumbent. My read is if a startup competes on price, the incumbent has no choice but to first let them gain a bunch of market share. It's too expensive for the incumbents to compete on price because a no-name startup is doing it. So they'd have to let you get relevant enough for it to make sense to compete on that axis.
I view it as a wedge to gain market share and later compete on something else.
unless the startup has gobs of free money how can they do this against an incumbent? note: nobody has gobs of free money anymore, except the incumbents. Startups competing on price is typically not a winning strategy, unless they have some technical advantage that shifts the price curve; subsidizing a move on it doesn't work.
This isn't commoditized because an incumbent has the market share, it's commoditized because there are dozens of providers in a crowded market. So what is likely going to happen is there will be a race to the bottom in terms of price.
PS - This is why I loathe advice from prominent software co operators. It's not one size fits all. Uber's strategy is going to be very different than Tesla's strategy which is going to be very different from Amazon's strategy.
Carving out market share and aiming for an acquisition exit is a valid win condition.
It also serves the consumers in the long run as it eventually will force competition and price reductions; effectively busting up price leadership dynamics.
Interesting, I looked into this. So The t4g.nano is 2 vCPU but only 0.5 GB RAM, so there's that trade off.
And from what I can tell as you bump more RAM, agent37 is around 5x cheaper: our 2 vCPU / 4 GB box is $4.94/mo (2/4/6 GB disk), vs AWS t4g.medium (the actual 2 vCPU / 4 GB Graviton box) at ~$24.50/mo
Tangentially, I've been investigating the last few days on how to setup a separate Linux box as an agent "playground". I got a mac mini to use as my own personal driver and now my Linux box is free, so I want to have a local setup where I keep my personal machine a bit stricter while giving near free-reign for agents on the Linux machine.
It is like a locally-hosted version of these commercial projects. But I'm doing it ad-hoc. This seems like a space that should be filled by open source. What are the options that exist now? I have pro plans for both Codex and Claude Code and enough credits to run a couple instances of each. I want to control them from the mac mini over a tailnet. What options exists now?
Agent Substrate from google if you wanna go hardcore, although it adds quite a bit of complexity and management that you probably don't want if it's just a personal setup - https://github.com/agent-substrate/substrate
Docker with tailnet is probably good enough for your usecase.
I recommend "byre" from that list, because I built it. You can inject credentials you want into it, but it can't touch the host. I run all my coding harnesses inside it. At the end of the day, it's a flexible and reusable way of spinning up Docker containers designed for agents.
Thank you for the resource, this kind of aggregation is very useful.
On a quick skim you have categories: Local, vendor-managed, Hybrid. I am looking for something in-between local and vendor-managed. In a sense, I want the separate box to be the sandbox, rather than have a sandbox on my local machine isolated using a container or VM. That is a bit different of a setup with its own constraints that things like VMs or containers don't directly address.
A self-hosted cloud offering is very close to what I was thinking of from a commercial offer. It is also the least documented, which makes sense. I'm guessing what I am trying to do is the niche case and most devs will either want to run on their local machine and/or a cloud. Therefore a commercial offering is obviously going to want to support local while providing a low-friction on-ramp to their commercial cloud product.
I currently have a few VMs in a Proxmox cluster that serve as sandboxes, talking to various inference machines, all self-hosted (so I don't have to worry about having "enough credits" either).
I've been working on this open source project for a few months, but just put up a product website today, actually: https://yaac.dev/
You can run the agents either sandboxed (in kubernetes via kind) or containerless ("free reign", perhaps) on the Linux box, and host them on your tailnet. The desktop app gives you either a chat or terminal interface, and you can access them via the browser (e.g. on mobile), too.
One limitation is that it assumes you're working with a github repo, and each agent session gets its own clone to work with. Feel free to shoot me an email (link in github) with any questions or specific needs and I'd be happy to try to help you.
Cron jobs were a big problem, especially if you want agents that must auto-sleep to save on costs. Since you cannot put the cron jobs within the sandbox container anymore, we eventually created our own cron API to wake up the sandbox and execute the cron
I've seen people set up crons to run every 15 minutes and accidentally spend a ton because the agent runs every time, even when there's nothing to do. Do you have a way to run a cheap check first and only wake the agent when something actually needs its attention?
Short-lived tokens only limit how long a credential works, but better than nothing. i.e. They don't stop an unwanted action while it's still valid.
A practical pattern is an outside broker: the guest never sees the real credential and can't pick the destination, only a path from an allowlist.
Shameless plug for my project, I maintain one of these brokers: Plimsoll's broker sits outside the sandbox, injects the upstream credential itself, matches method + exact path (no query strings, no traversal, no encoding tricks), and enforces (some limitations that I am want to improve) a total call budget plus per-route caps. So a task can be granted "GET /items/* plus at most one job submission" even when the underlying key is coarser.
We’ve taken the outside-broker approach in Stashbase.dev too. You manage the actual secrets in Stashbase and the proxy adds them to permitted requests. The agent gets a revocable session with host/method/path rules rather than the upstream key.
Still leaves the problem of an allowed request being a bad idea. Giving an agent access to a send-mail endpoint is a fairly big grant, even if it never sees the token. Which Google operations would you actually want to give it?
Congrats on the launch!. Looks awesome. One small gripe I have is that the user success stores seems obviously like claude has written them. I cancelled my claude sub for codex, partly because i cannot understand claude's style at all - not that there is anything is wrong with it, its effing incomprehensible.
Compare the two yourself and judge(latter is written in gpt-6 luna).
> One client is one API call. It comes back as an always-on Hermes agent that holds that client’s data, that client’s identity, and a hard ceiling on what it can spend. It answers on an OpenAI-compatible endpoint from the moment it boots, so integrating it was a base URL, the same as pointing at any model API.
> Boon provisions an agent for a client with one API call. Each agent has its own client data and identity, along with a spending limit. It exposes an OpenAI-compatible endpoint, so Boon can connect to it by configuring a base URL.
I answered this in detail in another comment above, but really the basics are skip the hyperscalers and place the pods more efficiently based on available resources.
Nice, you caught my eyeballs at the right time. I'm going to sign up for it. Cursor / GrokBot already gives me this, but I'm looking to recreate this setup as a backup so that I don't get locked in. This feels like the right direction. Move all this stuff off my desktop and then run everything from my phone.
haha, it's been on list for a while, but none of our customers have asked for it so far. But it's easy to build a custom Docker image with that harness and start using it.
When I saw 2 vCPU and 4GB, and then below that "4 GB persistent disk" I was like ooohhh it's the disk, not the memory. But it IS actually 4GB memory + 4GB disk.
This is amazing! We are using Box (now Boat dev) and yours is the first offering that looked even more economical. Will be exploring. Cheers and all the best
That's fair, capabilities wise we have to limit certain things on what gvisor based sandboxes can do in terms of things like networking, and other capabilities to compensate for this class if sandbox.
However over 80% of the use cases I'm seeing simply doesn't need much beyond that.
I used agent37 for a protoype a few weeks ago and it was amazing, awesome work. cold start time was ever so slightly annoying but nevertheless, cost is attractive
We have a few different types of sandboxes now. The default one's are optimized for cost so the cold start times are higher. But we're also launching performance and full VM which has better metrics on the other factors.
134 comments
[ 0.23 ms ] story [ 14.2 ms ] threadYC batch are becoming more like hunger games.
I know a few companies where this is just a feature like digitalocean it is just a feature.
How would you compare what you do to fly.io's Sprites (which is currently atop my To Try list)?
Fly certainly has great branding since they've been around for a while now. So they have a distribution advantage. But I think at some point they will also need to own some niche rather than just being a generic sandbox company, given how competitive the space is.
My use case was to play around with hermes. I was using it for a while but I didn’t like how it ended up (the whole set up became overran with files and was a mess, my fault).
I still haven’t 100% figured out how I may want to use the service again, but I thought it was super easy to set up.
My only feedback is that some connectors for google’s integration were kind of privacy nightmare the last time I checked.
Google’s API for using AI has abominable UI and set up.
It would be nice to be able to bridge the gap of simplifying Google’s AI/Service integration while not having to hand over access to every Google service I use.
For connectors we do offer managed MCPs like Composio, BraveSearch, and even an LLM gateway (which routes to openrouter). So what we have is simply a pass through for now and we're not looking to do more there. Since most of our early customers were just launching personal agents like Hermes, OpenClaw, Claude Code and wanted an easy white label setup.
Although now it's expanded to just sandbox usecases.
There is another even cheaper sandbox which is in YC (boat.dev)
How do you compare to them and how are you cheaper then they are?
Yeah, this seems like a niche where multiple startups are coming in. But if I remember correctly, we're about 3X cheaper than boat. We did a detailed comparison of all sandbox companies and where we stand across vendors here
https://www.agent37.com/pricing#sources
> When you look at agent harnesses, ... CPU/RAM utilization we could lower the cost.
How does it work today? Is the harness (assuming it means the agentic loop) located in a separate VM and each loop run invokes a separate sandboxing VM?
For convenience and cross-harness unified API we also built open source Gateway API - https://github.com/agent37-platform/gateway
Think of it as open router for Agent harnesses. So in our default templates we also run this and expose the APIs. So that makes using any harness easy as they all speak a single OpenAI responses API schema.
Got a bunch of Daytona credits which are close to useless given their restrictions until you hit tier 3.
You seem like you're actually slightly cheaper than https://boat.dev/ but with less storage? That's the closest to your pricing unless I'm mistaken. Any other insight as to differences between you two?
Also I'll add you to a list I've been maintaining of sandbox providers, congrats on the launch!
https://engine.build/lab/agent-sandboxes
We did some detailed pricing analysis here https://www.agent37.com/pricing#sources
For storage you can request more storage if your use case needs it. And yes would appreciate it if you can include us.
You guys are operating in a very competitive space. This stuff is fun to build, so a lot of engineers will end up building it. Not to discourage you, but I suspect it will be difficult to capture much value selling this offering as its going to be race to the bottom against very well funded alternatives that can sell these features at a loss in order to get you to use their databases and other offerings that are higher margin and stickier.
As you guys learn more about how to take this sort of technology to market, you may consider trying to get closer to the actual work that people actually need these agents to do. What can you do better because you have this technology? For example, I work in healthcare administration and we have built our own agent sandbox infrastructure on top of firecracker microvms that solve similar use cases as Agent37. We will never sell it. It's part of our competitive advantage for doing healthcare tasks.
Food for thought! Good luck!
But eventually I see us all moving in slightly different spaces as we specialize.
The promise of really cheap AI sounds amazing and is amazing. People will happily accept and engage with "free stuff"; but, I presume you are not starting a business to give away free stuff. Unless you have some model that let's you capture value some other way. e.g. Meta just gave everyone a small computer for free with Muse. Or have some sustainable price advantage on the underlying compute e.g. you are nvidia and make it yourself at scale.
I think you deserve to be compensated for your work! It's hard to make a sustainable business when selling something that costs $5 a month to developers (just seeing your calculator). There aren't that many of us, and AWS/GCP/Azure/Cloudflare have our credit cards already. If it were me, I'd be trying to figure out how to charge more and sell the value of the work you are enabling your customers to accomplish, not the cost of the underlying electrons.
Keep it up!
I view it as a wedge to gain market share and later compete on something else.
Easy to compete+huge margins -> lots of competitors who compete on price -> commotidization -> lower margins -> not good
PS - This is why I loathe advice from prominent software co operators. It's not one size fits all. Uber's strategy is going to be very different than Tesla's strategy which is going to be very different from Amazon's strategy.
It also serves the consumers in the long run as it eventually will force competition and price reductions; effectively busting up price leadership dynamics.
Can you show 1 case of this happening?
And from what I can tell as you bump more RAM, agent37 is around 5x cheaper: our 2 vCPU / 4 GB box is $4.94/mo (2/4/6 GB disk), vs AWS t4g.medium (the actual 2 vCPU / 4 GB Graviton box) at ~$24.50/mo
It is like a locally-hosted version of these commercial projects. But I'm doing it ad-hoc. This seems like a space that should be filled by open source. What are the options that exist now? I have pro plans for both Codex and Claude Code and enough credits to run a couple instances of each. I want to control them from the mac mini over a tailnet. What options exists now?
Docker with tailnet is probably good enough for your usecase.
I recommend "byre" from that list, because I built it. You can inject credentials you want into it, but it can't touch the host. I run all my coding harnesses inside it. At the end of the day, it's a flexible and reusable way of spinning up Docker containers designed for agents.
On a quick skim you have categories: Local, vendor-managed, Hybrid. I am looking for something in-between local and vendor-managed. In a sense, I want the separate box to be the sandbox, rather than have a sandbox on my local machine isolated using a container or VM. That is a bit different of a setup with its own constraints that things like VMs or containers don't directly address.
https://github.com/smol-machines/smolvm
You can run the agents either sandboxed (in kubernetes via kind) or containerless ("free reign", perhaps) on the Linux box, and host them on your tailnet. The desktop app gives you either a chat or terminal interface, and you can access them via the browser (e.g. on mobile), too.
One limitation is that it assumes you're working with a github repo, and each agent session gets its own clone to work with. Feel free to shoot me an email (link in github) with any questions or specific needs and I'd be happy to try to help you.
Does it have a layer that intercepts Cronjob creation, and setups up a reminder on the supervisor to wake the VM to run the agent job?
Cron jobs were a big problem, especially if you want agents that must auto-sleep to save on costs. Since you cannot put the cron jobs within the sandbox container anymore, we eventually created our own cron API to wake up the sandbox and execute the cron
https://www.agent37.com/docs/agents-api/crons#crons
i think the sandbox part is getting commoditized, like others said. the harder part is what the agent can touch inside it.
you connect google, the agent gets access to everything. sandbox protects the host. it does not protect your tokens.
scoped, short lived credentials per task. that i would pay more for. is it on your roadmap?
A practical pattern is an outside broker: the guest never sees the real credential and can't pick the destination, only a path from an allowlist.
Shameless plug for my project, I maintain one of these brokers: Plimsoll's broker sits outside the sandbox, injects the upstream credential itself, matches method + exact path (no query strings, no traversal, no encoding tricks), and enforces (some limitations that I am want to improve) a total call budget plus per-route caps. So a task can be granted "GET /items/* plus at most one job submission" even when the underlying key is coarser.
Worth a look if you're thinking about narrower credentials for services whose keys are still coarse: https://github.com/plimsollmark/plimsoll (docs/capability-grants.md, and the broker walkthrough at https://plimsollmark.github.io/plimsoll/trainers/brokering.h...).
Still leaves the problem of an allowed request being a bad idea. Giving an agent access to a send-mail endpoint is a fairly big grant, even if it never sees the token. Which Google operations would you actually want to give it?
Compare the two yourself and judge(latter is written in gpt-6 luna).
> One client is one API call. It comes back as an always-on Hermes agent that holds that client’s data, that client’s identity, and a hard ceiling on what it can spend. It answers on an OpenAI-compatible endpoint from the moment it boots, so integrating it was a base URL, the same as pointing at any model API.
> Boon provisions an agent for a client with one API call. Each agent has its own client data and identity, along with a spending limit. It exposes an OpenAI-compatible endpoint, so Boon can connect to it by configuring a base URL.
That's interesting though about Luna. I didn't realize GPT models are so much better at writing. I'll be taking another pass at these!
Do you have evidence for that? I’m personally more concerned about QEMU based escapes.
We have a few different types of sandboxes now. The default one's are optimized for cost so the cold start times are higher. But we're also launching performance and full VM which has better metrics on the other factors.