What happened
On Oct 27 Akamai introduced Akamai Agent Sandbox (beta) alongside Akamai Inference: agents run on Akamai Functions while the code they generate executes in a separate WebAssembly-isolated sandbox, sequestered from the agent runtime, with explicit limits on compute, memory, outbound connections and system capabilities. It ships as an open-source component of the Spin framework, with plans to add governance over what agents can reach.
Why it matters
Agent-generated code is a growing attack surface, and WebAssembly isolation gives a narrower, capability-restricted boundary than container or microVM sandboxing. It puts an isolated agent-execution runtime on a major CDN/cloud platform's edge network, so teams can run agents near data/users while containing the blast radius of the code they write.
Applicability
Teams building or buying agents that execute generated code (coding agents, workflow automation) and want edge-side isolation should pilot the beta, red-teaming its outbound restrictions and credential handling.