Hugging Face Sandboxes: run untrusted agent code in cloud VMs
Isolated VMs boot in ~6s from Python, the CLI, or the MCP server — plus hf_fs Hub search, pooled fan-out for evals, and a Claude Code workspace-escape fix.
Copy markdown
Isolated VMs, ready in ~6 seconds
Hugging Face Sandboxes spin up a fresh cloud VM in about 6 seconds and run each command in roughly 100ms, so an agent can execute untrusted or AI-generated code without ever touching your filesystem. You get full-VM or uid+Landlock isolation, CPU or GPU flavors, a 24-hour max lifetime, and your HF token stays out unless you opt in with forward_hf_token=True — all driven from Python (Sandbox.create()) or the hf CLI.
hf_fs makes the whole Hub one MCP tool
The upgraded Hugging Face MCP server exposes hf_fs, a single built-in tool that lets Claude, Cursor, VS Code, or Zed semantically search models, datasets, Spaces, docs, and papers — plus create repos, run Jobs, and launch those sandboxes from your editor. Copy the client-specific config from huggingface.co/settings/mcp and restart your client.
Fan out hundreds of sandboxes, cheap
SandboxPool packs many CPU sandboxes onto one billed VM, dropping per-box cost by that factor and cold start to roughly one network round-trip. It is built for RL rollouts, batch evals, and parallel tool execution — launch 100 environments across 2 VMs, then reconnect to any of them later from any machine with Sandbox.connect(id).
Claude Code 2.1.217 plugs a workspace escape
The latest Claude Code fixes background sessions not canonicalizing symlinked working directories — a gap that could let a session escape its workspace folder. It also kills a memory leak where truncated MCP tool outputs kept the full untruncated result in RAM for the rest of the session, and adds :emoji: shortcode autocomplete in the prompt.