AWS launches Nitro Sandboxes, hardware-isolated VMs for running AI agents and untrusted code on EKS, ECS and EC2

AWS made Nitro Sandboxes available on 9 November: lightweight VMs managed by the Nitro Hypervisor that give each EKS pod, ECS task or VM, including AI agents running LLM-generated code, its own hardware-isolated boundary on a shared EC2 instance. Enabling them in EKS or ECS is a one-line change, workloads can be validated through cryptographic attestation before secrets are released, and they are free on most Nitro-based instances in all commercial regions. The launch lands amid a wave of sandbox startups for AI agents.