---
title: AWS Launches Lightweight VM 'AWS Nitro Sandboxes' for AI Agents
url: https://www.elseif.net/aws-launches-lightweight-vm-aws-nitro-sandboxes-for-ai-agents
published: 2026-11-14T15:03:09+00:00
language: en
section: Harnesses
source: https://www.publickey1.jp/blog/26/awsaiec2vmaws_nitro_sandboxes.html
organizations: amazon, aws, ec2, nitro, sandboxes, web
publisher: elseif
---

# AWS Launches Lightweight VM 'AWS Nitro Sandboxes' for AI Agents

Amazon Web Services has announced the launch of a lightweight virtual machine called 'AWS Nitro Sandboxes', which operates with nearly native EC2 performance while providing a powerful isolation environment at the hardware level of the Nitro system. This offering is designed for the increasing opportunities to execute untrusted code generated by AI agents in lightweight virtual environments such as containers.

Traditional container-based virtualization often shares a kernel, which may not provide sufficient safety for isolation. As a result, there is a risk that executing malicious code could affect other containers or services on the same machine. Therefore, there has been a demand for lightweight virtual environments that offer robust isolation features.

The newly introduced AWS Nitro Sandboxes address this need by enabling a lightweight VM that incorporates strong isolation capabilities. The foundation of AWS Nitro Sandboxes is the AWS Nitro System, which delivers robust security and separation at the hardware level, upon which Amazon EC2 and AWS networking are built.

As the name implies, AWS Nitro Sandboxes leverage the powerful isolation capabilities of the AWS Nitro hardware while achieving nearly the same native execution speed as Amazon EC2. Users can utilize AWS Nitro Sandboxes as sandboxes on Amazon EC2, as well as Pods in Amazon ECS and Amazon EKS.

Within sandboxes configured with AWS Nitro Sandboxes, an operating system is provided that is completely independent from the host and other sandboxes or containers. System calls made within the sandbox cannot reach beyond the guest kernel of the sandbox.

In AWS EKS's auto mode, enabling AWS Nitro Sandboxes allows users to easily switch their Pods to the lightweight VMs offered by AWS Nitro Sandboxes. It is explained that existing container images, deployment pipelines, and Helm charts can continue to be used without change after the switch.