Three things dominated developer conversation this month: sandboxes for AI agents, a new round of Claude models, and JavaScript tooling being rewritten by agents. Here is what happened, with links to where it was reported, and what we think it means.
Agent sandboxes became infrastructure
Running agent code in isolation stopped being a niche idea in October. Money, open-source projects and standards bodies all moved at once.
- Money: Daytona reportedly raised a $60 million Series B at a $1 billion valuation to build cloud infrastructure for short-lived, stateful agent jobs.
- Open source:
- AWS released Strands Box in developer preview (Help Net Security). It combines operating-system isolation with rules that look at what an agent has already done before letting it run a command or call an API. It runs on Apple-silicon Macs, with Linux support planned.
- Kubernetes SIG Apps has an Agent Sandbox project that adds a
Sandboxresource for untrusted agent code, using gVisor or Kata Containers underneath.
- Standards: the Agentic AI Foundation took on Alibaba’s OpenSandbox, alongside Anthropic’s Agent Skills, OpenAI’s Open Responses and Hugging Face’s OpenEnv (AI Agents News).
- The platforms: a ranking published on 9 October lists six hosted options: Northflank, E2B, Modal, Daytona, Together Code Sandbox and Vercel Sandbox (Northflank; see also Modal and Cosmonic). They split into two camps:
- Firecracker microVMs, where each sandbox gets its own small VM (E2B, Vercel);
- gVisor and similar, where a user-space kernel sits between the code and the real one (Modal, and Northflank depending on configuration).
- On your own machine: coding agents now ship sandboxes too. Claude Code’s
/sandboxwraps shell commands with macOS Seatbelt, or bubblewrap on Linux and WSL2. It’s off by default (guide).
Why it matters. The same week, a malicious instruction file in a developer’s Downloads folder tried to make their coding agent install a malicious npm package (see this week’s security roundup). An agent with your shell and your credentials is only as safe as the files it reads. A sandbox has to limit four things: which files the agent sees, which addresses it can reach, which credentials it holds, and what it can push to git.
Our take, as people building a container runtime. An agent sandbox is a container problem with harsher rules:
- it has to start in milliseconds, because agents start thousands of them;
- it has to keep state between steps;
- it has to treat the code inside as hostile, not just buggy.
That is why the microVM approach keeps winning, and it’s the design space Kiri works in. We’ll go deep on it in a later post.
Claude Fable 5.1 and Opus 5.5: agent loops got cheaper
- Claude Fable 5.1 launched on 1 September (MacRumors, VentureBeat):
- a 1 million token context window and up to 128,000 output tokens;
- cache reads 75% cheaper, while base prices stayed the same;
- Anthropic says Claude Code users should see about 60% fewer cybersecurity false positives;
- generated text carries an invisible watermark, with a detection API in preview;
- a sibling model, Claude Mythos 5.1, has lighter safeguards and is limited to vetted security and life-sciences users.
- Claude Opus 5.5 followed on 22 September. Reports describe it as close to Fable 5.1 on most tasks at about 40% lower cost than Opus 5 (technews.tw, Vals AI).
Why the cache price matters most for agents. An agent loop sends the same long prefix on every step: system prompt, tool definitions and the conversation so far. Only a little is new each time. Most of the input tokens in a long agent run are therefore cache reads, and that’s the part that just got 75% cheaper. One outlet estimates typical workloads cost about 25% less, and highly agentic ones up to 45% less. We haven’t measured this ourselves yet, and the real saving depends on how well your prompts are cached.
JavaScript: TypeScript in Rust, and a quieter week for Node and Bun
- Cloudflare announced a Rust port of TypeScript, described as “written by agents, for agents”, with the line “We are not forking TypeScript” (The New Stack). It’s two trends at once: JS tooling moving to native code, and agents doing large rewrites.
- Bun 1.4.3 added
bun check, a built-in TypeScript type checker, and 1.4.4 focused on getting package installs right and fast (Bun, JSDevSpace). - Node.js shipped 26.12.0 and 24.22.0 on 14 October, then security releases on 21 October for 22.x, 24.x and 26.x. Update.
Also on Hacker News
From last week’s front-page digests (1, 2, 3):
- Kimi K3.1 Pro drew the most attention of any model release.
- OpenShell, a runtime for autonomous agents, was discussed as a way to run them in isolation.
- Astral shipped an experimental integration between uv, its Python package manager, and ty, its type checker.
- A post on building a container runtime from scratch did well. Its takeaway was that containers are just processes with kernel restrictions, which we agree with, and which is where most of the interesting work is.
Most links here are secondary coverage. Where numbers matter to you, check the vendor’s own announcement.