ANSM: Agile Network Substrate for Cloud-based Agent Sandboxes

Agent sandboxes let AI agents execute code, invoke tools, and access data in isolated, short-lived environments. At cloud-provider scale, networking must be provisioned for hundreds of sandboxes per node within milliseconds and must give each tenant access to its VPC and the Internet. We present ANSM, an agile network substrate that separates a high-density data plane on sandbox nodes from tenant-scoped network services on gateway nodes. Sandbox nodes pool pre-addressed virtual interfaces and use programmable forwarding, so every sandbox sees an identical network inside the guest while retaining a unique identity across the deployment. Gateway nodes hold public IP addresses and VPC interfaces as network services shared by all of a tenant's sandboxes, allowing these resources to be provisioned, scaled, and updated independently of sandbox creation. As a result, sandbox startup does not wait for slow cloud-resource provisioning, while public addresses and VPC interfaces remain isolated across tenants. In production, ANSM serves a rapidly growing sandbox workload, setting up each sandbox's network within milliseconds and supporting hundreds of sandboxes per node.