Cursor Cloud Agents can now execute inside Vercel Sandbox microVMs

Vercel has announced that Cursor Cloud Agents can now execute inside Vercel Sandbox rather than on Cursor's own hosted machines. According to Vercel's changelog post, the integration builds on Cursor's Self-Hosted Machines APIs, which let an organization provide the environment where its agents actually operate — cloning repositories, editing files, and running commands and tests. Cursor continues to own the agent harness and the inference loop; only the execution layer moves.

There is a licensing catch: Vercel notes that Self-Hosted Machines requires a Cursor Enterprise plan.

How the execution layer works

For every agent request, Vercel Sandbox provisions an isolated Firecracker microVM as the workspace. Around that, Vercel Functions and Vercel Workflow together form what Vercel describes as a durable control plane. Its job is to claim queued agent requests, provision workers, monitor active sessions, and clean up automatically once a session finishes.

In effect, the agent runtime is treated like any other ephemeral workload: created on demand, torn down when done, and isolated from everything else running in the account.

What the architecture delivers

Vercel highlights four properties of the setup:

• A worker pool that scales to zero, so teams are not paying for long-lived virtual machines that sit idle between agent runs.
• A dedicated, isolated Sandbox for each agent request, so concurrent agents never share an environment.
• Durable retries when a worker or session fails, rather than losing the run.
• Short-lived, user-scoped credentials inside each Sandbox, keeping any credential an agent uses tied to a single user and a narrow window of time.

Getting started

Vercel has published a step-by-step guide for deploying the reference implementation to a customer's own Vercel account, alongside the Vercel Sandbox documentation for deeper detail. Reproducing the setup means pairing a Cursor Enterprise plan with a Vercel account and following the deployment walkthrough.

Why it matters

AI coding agents increasingly execute arbitrary code — cloning repositories, running commands and test suites — so the environment they run in has become a governance question, not just an infrastructure detail. Running each request in a disposable microVM with scoped, short-lived credentials sharply limits the blast radius if an agent misbehaves or touches untrusted code, compared with shared, long-lived machines.

There is also a cost angle: a scale-to-zero pool means execution spend tracks actual agent usage rather than reserved capacity.

The bigger signal is architectural. Cursor's Self-Hosted Machines APIs separate the agent brain — the harness and inference loop that Cursor keeps — from the body, meaning the compute where the work happens. Vercel Sandbox is now one sanctioned answer for that body, and it points at a pattern likely to spread across agent platforms: vendors opening up execution so enterprises can run agents on infrastructure they choose, observe and control.