# Cloud sandboxes for coding agents · Oxagen Research

Source: https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents

[Research](https://oxagen.sh/blog) · [Product Releases](https://oxagen.sh/blog/pillars/product-releases)

# Cloud sandboxes for coding agents

A coding agent on a laptop stops when the lid closes or the plan's usage limit hits. Oxagen runs it in a sandbox on your Modal account, with every linked repository and a terminal that pauses it.

Oxagen Research · November 5, 2026 · 5 min read

*   [Product Releases](https://oxagen.sh/blog/pillars/product-releases)
*   [Coding agents](https://oxagen.sh/blog/pillars/coding-agents)

You send an agent a fix at six in the evening. The ticket is in the API, so you start Claude Code in the API repository on your laptop and go home. Three things can end that run before morning. The laptop sleeps. The Claude plan reaches its five-hour session limit at two in the morning, and nothing restarts the session when the limit resets. Or the fix needed a type from the shared library, which sits in a repository the agent never had.

When you look the next day, you find a half-done branch and a session you have to read from the top. You restart the run by hand and wait again.

Oxagen 5.5.0 moves that run off the laptop. The run starts in a cloud sandbox, a small isolated machine that holds one run, with every repository the workspace links already checked out. When the plan's limit hits, the run waits and picks up the same session once an account is free. When the run goes past its work item's time limit, Oxagen stops it. When you want to type into the session, the terminal pauses the agent before your first key lands.

## How a sandbox run starts

A sandbox run starts on your own Modal account. Modal sandboxes are built for running code a model wrote, apart from everything else on the account.[1](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-1) Isolating each workload in its own container is the standard guidance for code you do not fully trust.[2](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-2) Your Modal account pays for the compute, and Oxagen bills none of it. The model calls use your own credential, an Anthropic API key or a Claude subscription login for Claude Code. That credential stays in Oxagen's gateway and never enters the sandbox. Every host the sandbox reaches, it reaches through that gateway.[3](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-3)

You can start a run from any of the places you already work:

*   **The app.** Launch run on the Runs page takes a harness, a repository, a branch, and a prompt, a work order, or an open terminal.
*   **A stella thread.** The assistant sends a work item to an agent on a cloud environment. The send waits for you to confirm it.
*   **The CLI.** `oxagen sandbox run --harness claude --workspace-slug <slug> --repo <owner/name> --prompt "..."`.
*   **MCP.** A coding agent calls the `launch_sandbox_run` tool.

Each path calls the same capability, `launch_sandbox_run`. Oxagen checks the launch before any sandbox starts. A missing model credential or a rule that denies the run is refused with the reason, and no sandbox time is spent.

## How linked repositories reach the sandbox

A fix in the API often needs the shared library's types or the web app's callers. Research on code completion found that models struggle when the context from other files is missing, and improve when it is added to the prompt.[4](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-4) SWE-bench draws its tasks from real GitHub issues, and its authors found that resolving them often means coordinating changes across several functions, classes, and files at once.[5](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-5) An agent that sees one repository has to guess at the rest.

So each sandbox run checks out every code repository its workspace links, up to 50. The repository you named is the target. The run clones it on your branch, and the agent starts there. The others follow on their default branches, in the order the Repositories page lists them. Each one sits at the same path in every run, such as `/workspace/acme/api`, so a setup script can name a sibling by its path. The run can push to each repository it checked out, under the same mandate and branch rules as a push to the target. Steering repositories stay out of the checkout.

## What happens at a plan's usage limit

Claude's Pro and Max plans carry a five-hour session limit and a weekly limit.[6](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-6) On a laptop, a run that hits one simply stops. In a sandbox, the run waits.

How a sandbox run waits out a usage limit

1.  RefusedEvery model account the run may use refuses its call.
2.  WaitingThe gateway holds the run and refuses its calls until an account resets.
3.  CheckedEvery 15 seconds Oxagen reads each waiting run's accounts again.
4.  ResumingAn account is free, so Oxagen marks the run to continue.
5.  ContinuedThe sandbox reopens the same Claude Code session.

Illustrative. The states a Claude Code run in a sandbox moves through when its accounts reach their usage limits.

The gateway tries each account the run may use, in order. When every one refuses, the gateway puts the run in a wait. Claude Code ends its turn and exits. The program that started it in the sandbox asks the gateway whether to continue, and holds the sandbox while the run waits. Oxagen reads the waiting runs every 15 seconds, so an account you add or repair counts before its recorded reset. Once an account is free, Claude Code reopens the same session and picks up the work.

The wait has a budget. A run gets its first pass through the accounts plus six retry rounds. After the last round, the run ends failed. A run its operator cancels stops waiting at once.

## How the time limit stops a stuck run

A run that cannot make progress keeps spending. In one long-horizon benchmark, agents fell into loops that ran off task, and they rarely recovered.[7](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-7) A sandbox makes that cheaper to start, which also makes it cheaper to forget.

So a run that works on a work item carries the item's time limit, one and a half times its estimate. Every 15 minutes Oxagen lists the runs past their limit and stops each one. The stop is recorded as Oxagen's, with a reason that names the limit and the estimate, and the sandbox ends with `time_limit` as its end reason. A run with no work item ends at its cloud environment's run limit, if you set one.

## How to type into a running session

Sometimes you want to type into the agent's session yourself. The danger is typing while the agent is still working, so two writers edit one session.

Open terminal on the Run page opens the run's terminal in a drawer, and the drawer starts by watching. Take control sends a pause to the run. The terminal relay, the service that carries your keys to the sandbox, refuses every keystroke until the run reports the pause applied. Then the keyboard is yours. Resume the run hands control back to the agent. Only one session holds a run's keyboard at a time, and only the operator who launched the run can open its terminal. Closing the drawer leaves the run and its pause as they are, so a paused run stays paused until someone resumes it.

## What this release does not cover

*   **Plan and account.** Sandbox runs depend on an entitlement your plan grants, and every cloud environment runs on your own Modal account. The sandbox figures Oxagen reports are estimates.
*   **Stella.** A headless Stella run that hits its accounts' limits ends instead of waiting, because `stella run` cannot reopen a session it left. An interactive Stella run reopens its last session. Stella needs a template built on base layer 1.5.0 or later.
*   **Codex.** A Codex run needs a template built on base layer 1.6.0 or later and an OpenAI API key. Codex runs do not use a ChatGPT login yet.
*   **Repositories.** A template built before base layer 1.7.0 checks out only the target repository. Rebuild the template on the Runtimes tab to move it over. A repository linked after a run starts is not in that run.
*   **The time limit.** Oxagen checks every 15 minutes, so a run can pass its limit by up to that long before it stops.

The setup steps, the credentials each harness takes, and every reason a launch is refused are on the docs page for agent sandboxes.[3](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fn-3) The rest of this release is in the [Oxagen 5.5.0 post](https://oxagen.sh/blog/oxagen-5-5-0).

## References

1.  Modal (2026). _Sandboxes_. Modal Docs. [https://modal.com/docs/guide/sandbox](https://modal.com/docs/guide/sandbox) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-1)
    
2.  Souppaya, M., Morello, J., & Scarfone, K. (2017). _Application Container Security Guide_. NIST Special Publication 800-190. [https://csrc.nist.gov/pubs/sp/800/190/final](https://csrc.nist.gov/pubs/sp/800/190/final) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-2)
    
3.  Oxagen (2026). _Agent sandboxes on Modal_. Oxagen docs. [https://docs.oxagen.sh/docs/agent/sandboxes](https://docs.oxagen.sh/docs/agent/sandboxes) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-3) [↩2](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-3-2)
    
4.  Ding, Y., Wang, Z., Ahmad, W. U., Ding, H., Tan, M., Jain, N., Ramanathan, M. K., Nallapati, R., Bhatia, P., Roth, D., & Xiang, B. (2023). _CrossCodeEval: A Diverse and Multilingual Benchmark for Cross-File Code Completion_. NeurIPS 2023 Datasets and Benchmarks. [https://arxiv.org/abs/2310.11248](https://arxiv.org/abs/2310.11248) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-4)
    
5.  Jimenez, C. E., Yang, J., Wettig, A., Yao, S., Pei, K., Press, O., & Narasimhan, K. (2023). _SWE-bench: Can Language Models Resolve Real-World GitHub Issues?_ ICLR 2024. [https://arxiv.org/abs/2310.06770](https://arxiv.org/abs/2310.06770) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-5)
    
6.  Anthropic (2026). _Use Claude Code with your Pro, Max, or Ultra plan_. Claude Help Center. [https://support.claude.com/en/articles/11145838-use-claude-code-with-your-pro-max-or-ultra-plan](https://support.claude.com/en/articles/11145838-use-claude-code-with-your-pro-max-or-ultra-plan) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-6)
    
7.  Backlund, A., & Petersson, L. (2025). _Vending-Bench: A Benchmark for Long-Term Coherence of Autonomous Agents_. arXiv. [https://arxiv.org/abs/2502.15840](https://arxiv.org/abs/2502.15840) [↩](https://oxagen.sh/blog/cloud-sandboxes-for-coding-agents#user-content-fnref-7)