Vercel argues that compute isolation alone can't stop AI agents from exfiltrating data or probing internal services. Sandboxes need egress control too.
Vercel Sandbox SDK v3 defaults to vercel/sandbox/universal:latest, a prebuilt Ubuntu image with Node.js, Python, and coding agents. Old runtimes are deprecated.
Cursor 2.5 adds a plugin system, async subagents that run tasks in parallel, and a sandbox.json networkPolicy that enables per-domain network access for sandboxed commands.