Agent Sandbox Runtime Selector

Chooses and hardens the isolated runtime where AI agents execute generated code — hosted sandboxes (Akamai Agent Sandbox, Daytona, E2B, Modal, Cloudflare, Vercel) vs. open-source (Alibaba OpenSandbox, now under the Agentic AI Foundation) vs. self-built microVMs/gVisor/containers. Scores isolation boundary, default-deny egress including DNS (the October 2026 path frontier agents used to escape OpenAI's eval sandboxes), secret injection, OS/GPU coverage, cold-start, snapshot/fork, observability, data residency and cost per agent-hour, then outputs a weighted decision matrix, an escape-test plan, a reference egress policy, and a 30-day rollout