Incredibuild's Islo: A Persistent Sandbox Built for AI Agents, Not Human Developers

AI coding agents running on developer machines are exhibiting a behavior that no one built the infrastructure to handle: they run continuously, accumulate credentials, spawn processes, and don’t go to dinner. The developer-centric assumptions baked into existing cloud environments are creating a security and resource management gap that most platform teams have not yet addressed.

Incredibuild’s response is Islo, a sandbox architecture that treats the AI agent — not the human — as the principal user. The design choices that follow from that premise are substantively different from anything currently in the cloud dev environment market.

Context

GitHub Codespaces, Daytona, and Coder were built with a clear mental model: a human developer opens an IDE, works for a session, and the environment idles or shuts down when the session ends. That idle behavior is intentional — it reduces cost and contains blast radius. The security model also reflects that assumption: the developer is trusted, the environment is their workspace, and the policy layer lives at the network edge.

AI agents break every one of those assumptions. They don’t attach to IDEs. They don’t idle. They operate indefinitely on tasks with no natural session boundary. And their credential requirements are both broader (they need access to repos, APIs, and deployment targets) and harder to scope than a human developer’s interactive session. Agents running in a shared dev environment are, effectively, a new attack surface that organizations didn’t have before they deployed coding assistants.

The Detail

Islo is built around the opposite architecture. Each agent gets its own persistent, isolated cloud environment with a lifecycle that is not tied to human working hours. Sessions have no ceiling. The environment persists for as long as the task requires.

The policy layer is the key differentiator from ephemeral sandboxes. Ephemeral approaches — optimized for sub-second cold starts and immediate teardown — work well for isolated code execution but lack the persistent state and scoped credential management that multi-step agent tasks require. Islo positions a policy layer between the agent environment and everything outside it, scoping what the agent can reach, what credentials it can access, and what it can affect in production-adjacent systems.

Incredibuild is building toward a model of “one persistent, addressable machine per agent, with its own scoped credentials.” That framing matters: it means the agent’s identity is a first-class architectural concept, not an afterthought mapped onto existing human user management. This aligns with the broader non-human identity problem in enterprise infrastructure — where the number of machine identities now substantially exceeds human identities, and the governance tooling has not kept pace.

Beyond Islo, Incredibuild announced a broader platform refresh targeting the full SDLC — from code commit to deployment — with AI-native bottleneck elimination as the organizing principle, accelerated by its acquisition of AI startup Kypso.

Source: The New Stack

Content created with AI assistance and reviewed for accuracy.