AWS has launched Nitro Sandboxes, lightweight virtual machines that give workloads on EKS, ECS and EC2 a hardware-isolated environment. For teams running AI agents or other untrusted code, the practical promise is to share an EC2 instance without sharing the same isolation boundary.
AWS AI Watch analysis
What happened
AWS says each sandbox runs as a lightweight VM managed by the Nitro Hypervisor. Teams can run EKS pods or ECS tasks in their own sandbox, or use EC2 directly for more control. AWS says enabling sandboxes for EKS pods or ECS tasks takes a one-line change, with existing features including Pod Identity, VPC CNI, EBS, EFS, S3 and CloudWatch working out of the box.
The launch also supports cryptographic attestation. AWS says secrets can be released only to sandboxes that have proved their integrity. Amazon Linux and Firecracker are supported natively; AWS says patches for other virtual machine monitors are available. The service is available at no additional charge on most Nitro-based EC2 instances in commercial AWS Regions worldwide.
Why it matters
AI agents may need to run code generated by a model, and that code should not automatically be trusted with the rest of the machine or its neighbours. AWS is offering a hardware-backed isolation option for running those workloads, while allowing multiple sandboxes to share one EC2 instance. The company says this can improve utilisation and lower compute costs, though it does not provide figures in the announcement to quantify those gains.
The scope extends beyond AI agents: AWS also positions the feature for untrusted, multi-tenant and regulated workloads. That makes it an infrastructure change for teams using EKS, ECS or EC2, not a new model or agent product.
Our read
This is a useful building block for anyone letting software run code on behalf of a model. The notable bit is the combination of per-workload VM isolation and attestation, not the suggestion that one line of configuration makes every security question disappear. Teams still need to decide what secrets a workload should receive and how to manage the surrounding system. But AWS has made stronger isolation available across three familiar compute routes, without an added service charge.
What to watch
- How the one-line setup works in real EKS and ECS deployments.
- What performance and cost results customers see when sharing instances across sandboxes.
- Which virtual machine monitors AWS supports beyond Amazon Linux and Firecracker.
- How teams use attestation to control access to secrets.
Discussion spark: Would you run model-generated code in a shared EC2 instance if each workload had its own hardware-isolated sandbox, or is a separate instance still worth the extra cost?
Sources and evidence
- Introducing AWS Nitro Sandboxes on Amazon EKS, ECS and EC2 for hardware isolated pods, tasks and VMs (9 November 2026, 08:00 UTC)
not affiliated with or endorsed by Amazon Web Services (AWS)