Daytona vs AgentBox vs DIY: Sandbox Runtime for AI Agents

TL;DR: Four platforms now compete to give AI coding agents a persistent, always-on cloud computer: Boxd (hardware-isolated KVM, $2M raised September 15), Cursor Self-Hosted (orchestration bridge for enterprise Cursor users), Daytona (programmatic sandbox API, closed-source since June), and Grass (mobile-first control layer on Daytona VMs). If you need hardware isolation and sub-100ms forking, choose Boxd. If your team runs Cursor and wants to move compute onto private infra, choose Cursor Self-Hosted. If you need a programmatic SDK to build agent infrastructure, choose Daytona. If you want a zero-setup always-on VM with mobile oversight for Claude Code, Codex, or OpenCode, choose Grass.

Why does this category exist now?

The core problem driving all four platforms is identical: Claude Code, Codex, and OpenCode are laptop-tethered. GitHub issue #63023 (May 2026) documented the failure mode precisely — background agents silently die on session pause, leaving worktrees in mid-rebase states with zero notifications and no recovery path. One developer reported losing 6 parallel agents overnight:

"Pause window 2 (overnight gap ~16 hours): A batch of 6 background agents dispatched at 20:44 IST. Session resumed at 12:25 IST the next day. ZERO of the 6 agents produced a PR on origin. ZERO completion notifications fired. All 6 worktrees were in stale partial-work states." — GitHub issue #63023, anthropics/claude-code

The week of September 8–15, 2026 crystallized a category name for the solution. Boxd raised $2M on September 15 explicitly naming "always-on cloud VM for AI coding agents." Cursor launched self-hosted machine support on September 2. Meta shipped Muse on dedicated Secure VMs on September 8. Three independent launches, same architectural thesis: every AI agent needs its own persistent cloud computer — not a disposable sandbox.

This is a category formation moment. The question is no longer whether to move agents off your laptop. The question is which infrastructure to move them to.

What are the four platforms competing in this category?

Boxd is a custom KVM hypervisor purpose-built for AI coding agents. It provides hardware-isolated persistent VMs with sub-100ms live forking (so you can instantly clone a running agent's state), BYOK (bring-your-own-key) credential isolation, and a team-facing dashboard. Priced at €0.22/hour for a default 2 vCPU / 8 GiB machine, hibernated machines pay for disk only.

Cursor Self-Hosted Machines are not a standalone VM product — they are an orchestration bridge. The Cursor agent loop, inference, and planning remain in Cursor cloud; only the execution environment moves to user-owned infra. This means the agent's compute can run on hardware you control, but Cursor's model choices (now defaulting toward Grok after SpaceX's acquisition) stay in Cursor cloud. Enterprise customers like Brex, Money Forward, and Notion are early adopters.

Daytona is the most established programmatic sandbox platform in the space. It provides a developer-facing SDK and API over containers, VMs, GPU workloads, and macOS — the widest surface of any platform here. Priced at $0.05/vCPU-hr. Crucially: Daytona went closed-source on June 11, 2026, citing AI-assisted vulnerability discovery making their public codebase a liability. The previously open "default runtime for AI agents" is now a proprietary service with $24M of funding behind it.

Grass is an always-on cloud VM paired with a mobile-first control layer. It runs on Daytona infrastructure under user credentials, has Claude Code, Codex, and Open Code pre-loaded, and provides a native iOS app for monitoring, diff review, and permission gates. Free tier: 10 hours, no credit card. Grass's internal data shows 68% of sessions start on iPhone — validating real mobile-first demand, not just a feature checkbox. Grass is agent-agnostic by design: Claude Code, Codex, and OpenCode are all first-class citizens.

What criteria actually matter when choosing always-on agent infrastructure?

The right criteria depend on your setup. Five questions matter most:

1. Isolation model: Do you need hardware-level VM isolation, or are containers acceptable? Boxd uses custom KVM. Daytona and Grass default to containers with VM options.

2. Persistence model: Does the session survive your laptop sleeping, a network drop, or a cloud provider restart? All four platforms solve laptop-tethering, but they differ in how they handle provider-level interruptions.

3. Multi-agent scaling: Can you run 10 parallel agents on different repos simultaneously? Boxd's live forking makes this trivially fast. Daytona supports it programmatically via SDK. Grass and Cursor have per-session models.

4. Model lock-in: Are you committed to one model provider? Cursor Self-Hosted increasingly defaults toward Grok (xAI) post-SpaceX acquisition. Boxd, Daytona, and Grass are model-agnostic.

5. Setup cost: How quickly can you go from zero to a running agent? Grass has the lowest setup cost (QR scan + free tier). Daytona requires SDK integration. Boxd requires account setup and team provisioning. Cursor Self-Hosted requires existing Cursor enterprise.

Comparison table: Boxd vs Cursor Self-Hosted vs Daytona vs Grass

When should you choose Boxd?

Boxd is the right choice when hardware isolation is a hard requirement and you're running agent VMs at team scale. The co-founder Hidde Kehrer framed the problem clearly:

"Every AI coding agent needs a real computer to run on rather than a disposable sandbox. Current container alternatives suffer from security vulnerabilities and lose state as soon as processes complete."

The sub-100ms live forking is a genuine technical differentiator — cloning a running agent's state at that speed is not achievable on container runtimes. For teams doing multi-agent workflows where you want to branch from a known-good agent state, that matters. The €0.22/hr pricing means a fleet of VMs only costs money while working (hibernated machines pay disk only), which makes the economics tractable for parallel agent workflows.

The main watch-out: Boxd raised its $2M two weeks ago. The product is real, but the operational track record is short. Evaluate carefully for production-critical workflows until there's more usage history.

When should you choose Cursor Self-Hosted Machines?

Cursor Self-Hosted is the right choice when your team is already on Cursor enterprise and compliance or data residency requires execution to happen on your own infra. It's not really competing in the "always-on persistent VM" category — it's more accurate to call it an "orchestration bridge": Cursor's cloud stays responsible for the agent loop and model selection, while your infra provides the execution environment.

The important tradeoff: post-SpaceX acquisition, Cursor's model choices default toward Grok. If you need model-agnosticism — the ability to pick Claude on one project and GPT-4o on another — Cursor Self-Hosted doesn't give you that. You're trading compute control for model control.

For an independent discussion of the Cursor vs model-neutral infrastructure tradeoff, the Grass vs Cursor comparison covers the architectural differences in detail.

When should you choose Daytona?

Daytona remains the most programmatically capable platform in this space. If you're building agent infrastructure — a background agents SDK, a multi-repo orchestration layer, a CI pipeline that spins up isolated agent environments on demand — Daytona's API and SDK surface is the most mature option. The $0.05/vCPU-hr pricing is the most granular in the group.

The closed-source pivot in June 2026 is a real strategic shift. Daytona's public GitHub repo now reads: "As of June 2026, Daytona's core development has moved to a private codebase. This repository will receive no further updates, fixes, or releases." For teams that were relying on the open-source safety valve (audit the code, self-host if needed), that option is gone. The two April 2026 security incidents (CVE-2026-31431 and an API credential exposure) that preceded the closure are worth understanding before you depend on it in production.

One practical setup reference: How to Set Up Claude Code on Daytona walks through creating a Daytona workspace, installing Claude Code, and connecting it to Grass for phone monitoring.

When should you choose Grass?

Grass is the right choice when you want a zero-setup always-on VM for individual agent work and mobile oversight matters to you. The free 10-hour tier removes the cost barrier for evaluation. The native iOS app with permission gate forwarding solves the specific problem developers actually complain about: permission prompts that block an agent while you're away from your desk.

The 68% iPhone session start rate from Grass's internal data is the clearest evidence that mobile-first agent control represents real demand, not a marketing angle. The 3× completion rate vs laptop-only sessions suggests that having a phone-accessible permission gate is meaningfully changing agent outcomes — agents that would have stalled on an approval prompt are now completing.

The dependency risk worth naming honestly: Grass runs on Daytona infrastructure under user credentials. If Daytona changes pricing, reliability, or access terms, Grass changes too. That's a concentration risk that Boxd (running its own hypervisor) doesn't have.

How does the DIY alternative compare?

DIY — a VPS plus tmux, Tailscale, and SSH — remains a valid option for single-user, single-agent setups with straightforward persistence needs. The cost floor is lower ($5–10/month on Hetzner or DigitalOcean). The control ceiling is higher (you own the infra, the networking, the security model).

The problems start at scale and convenience. Running 5 parallel agents on different repos requires either 5 terminal sessions or tmux panes. There's no mobile approval gate — you either skip permissions (--dangerously-skip-permissions) or SSH in from your phone when something blocks. Setting up a new project means SSH + tmux session + authentication. Every new team member needs the same setup.

The HN commenter who posted "I've hopelessly lost track of the 'vm for agents' space. Fly.io sprites. Modal. Blaxel. Morph. Daytona. Runloop. Ascii Box... I'm surely only scratching the surface" is describing the real problem with DIY: it requires tracking and evaluating a fragmented ecosystem of primitives. The managed platforms in this comparison are betting that most developers would rather pay to not do that.

For developers who want to stay DIY but need persistent Claude Code sessions, Keep Claude Code Running After SSH Disconnects and the VPS setup guide cover the baseline configuration.

What does this category look like six months from now?

The "always-on cloud VM for AI coding agents" category is at the same inflection point as managed databases in 2012 or managed Kubernetes in 2019. The technical primitives exist. The pain is real and documented. Capital is arriving (Boxd's $2M, Daytona's $24M). The open question is whether developers will pay for managed infrastructure or converge on a DIY standard.

Three signals worth watching: (1) Whether Boxd's live fork feature drives team adoption fast enough to build network effects before Daytona replicates it. (2) Whether Cursor's model lock-in post-SpaceX creates meaningful developer migration toward model-agnostic platforms. (3) Whether the Daytona closed-source pivot opens space for a transparent open alternative.

Meta's Muse Secure VM launch — a consumer product giving each AI user a hardware-isolated cloud computer — validates the architectural thesis at a different scale. A 0-day was found by an external researcher shortly after launch, underlining that per-user VM security is an unsolved problem the whole category shares. Developers evaluating any of these platforms should understand the security model before running agents with production credentials.

Frequently Asked Questions

What is the difference between Boxd and Daytona for AI coding agents?
Boxd uses a custom KVM hypervisor for hardware-isolated persistent VMs with sub-100ms live forking — it's positioned as a machine developers and agents live on, not a sandbox for code execution. Daytona provides a programmatic SDK/API for spinning up containers, VMs, GPU workloads, and macOS environments on demand. Daytona is the better fit for building agent infrastructure programmatically; Boxd is the better fit for teams that need hardware isolation and team-accessible persistent agent machines.

Why did Daytona go closed-source in June 2026?
Daytona's README now states: "As of June 2026, Daytona's core development has moved to a private codebase." The company cited AI-assisted vulnerability discovery making their public codebase a liability — two security incidents in April 2026 (CVE-2026-31431 and an API credential exposure) preceded the decision. The open-source repository no longer receives updates or releases.

Can I run Claude Code, Codex, and OpenCode on the same always-on VM?
Yes — Grass, Daytona, and Boxd are all model-agnostic and can run multiple agents on the same infrastructure. Cursor Self-Hosted is agent-specific: the execution environment runs on your infra, but the agent loop stays in Cursor cloud. If you need to run Claude Code on one task and Codex on another without switching platforms, avoid Cursor Self-Hosted and choose any of the other three.

What does "always-on cloud VM" mean vs an ephemeral sandbox like E2B or Runloop?
Ephemeral sandboxes (E2B, Runloop, Modal, Vercel Sandbox) are designed for short-lived programmatic execution — spin up, run code, tear down. State doesn't persist between runs. Always-on VMs (Boxd, Grass, Daytona workspaces) persist state, keep the agent process alive between sessions, and survive laptop sleep or network drops. The difference matters for multi-hour autonomous tasks: an ephemeral sandbox will lose all context when the task hits a session boundary.

Is the DIY approach (VPS + tmux) still competitive in September 2026?
DIY remains the right answer for single-user, low-parallelism setups where you want maximum control and minimum cost. It breaks down when you need parallel agents across multiple repos, mobile approval gates, or zero-setup project onboarding. The managed platforms charge for the operations you'd otherwise do yourself — the value calculation depends on how much that operations time costs you.

Grass is an always-on cloud VM for AI coding agents — Claude Code, Codex, and Open Code pre-loaded, accessible from your phone or laptop, with native permission gate forwarding. Free tier at codeongrass.com.