MicroVM sandboxes for AI agents: How a hibernating virtual machine keeps an agent contained

A microVM sandbox is a small, stripped-down virtual computer that an AI agent gets all to itself. The agent can install software, run commands and open a browser inside it. If something goes wrong, the damage stays inside that one machine. The same design lets the machine be frozen to disk and woken later.

Cognition describes this approach as the base of Devin and, since its launch of Devin Apps, of the private tools that Devin builds. Per Cognition’s post, an App runs on Devin’s own machine, which sleeps when nobody uses it.

Why a code-writing agent should not share a machine

Picture a shared office where every contractor works at the same desk. One careless person can read another’s papers. A container is similar. Containers separate programs, but they share one operating system core, called the kernel.

Cognition’s April 2026 post on cloud agents argues this is risky for agents. Agents, it says, generate their own code, run arbitrary commands and probe their environment in unpredictable ways. With containers, it writes, one compromised session can reach every other container’s files, credentials and network connections.

Its answer is what it calls the industry standard for untrusted code: VM-level isolation, where each workload gets its own kernel and no shared attack surface. VM stands for virtual machine, a software-made computer that runs inside a real one.

What makes a microVM different from a normal virtual machine

Traditional virtual machines are heavy. They emulate a lot of hardware and take a while to start. A microVM keeps the strong separation but drops almost everything else.

The best-known example is Firecracker, an open source project (Apache 2.0, written in Rust) built by AWS developers for secure, multi-tenant container and function workloads. Its project page lists these figures:

• Boot time under 125 milliseconds.
• Memory overhead under 5 MiB per VM.
• Up to 150 microVMs created per second on one host, with thousands running on one server.
• Only 5 emulated devices, which keeps the attack surface small.

Those are the project’s own claims, measured by its authors. The page says it grew out of the needs of AWS Lambda, and that it now powers Lambda at very large scale.

Cognition does not say it uses Firecracker. It says its own microVM work took more than a year of hypervisor engineering. A hypervisor is the software layer that creates and runs virtual machines. The goal, in its words, is that every agent session runs on a dedicated kernel with isolated storage, networking and compute.

Freezing a whole computer and waking it later

Real work has long pauses. An agent may wait on a test run or a code review for minutes, hours or days. Cognition says containers cannot reliably snapshot one container’s full state. To survive a wait, a container has to burn compute staying alive, and if it is rescheduled or crashes, the session is lost.

A virtual machine can be saved whole. Cognition says it snapshots full machine state at the hypervisor level: memory, process trees and the filesystem. A process tree is the set of running programs and the programs they started. Saving memory means those programs resume mid-thought, not from a fresh boot.

Think of closing a laptop lid rather than shutting it down. Everything is where you left it when you open it. Per Cognition, an idle agent stops drawing compute, and when a result or a comment finally arrives, the session picks up at the very point where it paused.

How Devin Apps put this to use

The Devin Apps launch reuses the same mechanism for a different job. Cognition’s post says Apps are built on memory snapshots, which let Devin hibernate between tasks. When nobody opens the App, the machine sleeps. The next visit wakes it. Cognition says the first load after a sleep can take a few seconds.

This changes how the bill works. Per the post, billing is based on how long the machine is awake. A tool opened a few times a day would spend most of its life asleep. The post gives no price, so the actual cost is unknown.

The design also explains the limits Cognition states. An App runs on one machine. That suits internal tools and dashboards, the post says, not high-traffic production services. Everyone who opens an App must also sign in to Devin, and Apps are never public.

Trade-offs and what to watch

Strong isolation is not free. Cognition says that standing up VM-based isolation for agent workloads is a significant undertaking, and that managing thousands of concurrent VMs was harder than any other infrastructure it had built. That covers provisioning, predicting demand for warm machines, crash recovery and teardown.

Snapshots add their own questions. A saved memory image may hold secrets, such as logged-in sessions, so where it is stored and who can restore it matters. Wake-up delay is another cost, even if only a few seconds. A single machine is also a single point of failure and a ceiling on traffic.

Cognition’s post also notes that VMs let agents use a full browser, desktop applications and arbitrary tool stacks, much like a developer’s workstation. That convenience is the reason agents need more than a locked-down function runner.

Three things are worth watching. First, whether vendors publish prices for sleeping and awake time. Second, whether security teams get clear rules for what a snapshot contains. Third, whether other agent products move from containers to microVMs as agents take on longer, riskier jobs. For now, this design is a vendor’s account of its own platform, and independent testing of the claims is thin.