<- all tokdocs
2026.09.01@isaacdyor

agentOS Runs Coding Agents Inside Your Node Process Instead of a Sandbox VM

AI
Watch on TikTok

View on TikTok ->

agentOS is a real, Apache-2.0 library from Rivet that runs an agent's filesystem, shell, and processes inside your existing backend process, and its headline "250x cheaper" number is the most favorable case in Rivet's own benchmark table. The video is entry five in Isaac Dyor's series on open source repos, and it makes three claims: agents run 50 times faster and 250 times cheaper than on a sandbox, and you can attach a sandbox when you need native binaries. The repo exists at github.com/rivet-dev/agentos with 4,645 stars and 251 forks as of September 19, 2026, and the README banner reads "92x faster cold starts, 47x less memory, 254x cheaper than sandboxes." Rivet's own performance documentation shows that the cost multiplier swings between 32x and 1,738x depending on which workload and which hardware you pick.

What the library actually does

agentOS gives each agent a lightweight virtual machine that boots inside your Node.js process. Guest JavaScript runs in V8 isolates and compiled tools run as WebAssembly, so there is no container to pull and no microVM to boot. Rivet describes warm VM creation as single-digit milliseconds with each VM costing tens of megabytes.

The piece that makes it more than a code runner is bindings. Agents call functions in your backend as ordinary JavaScript calls rather than over a network hop, so credentials stay on the host and the agent sees only inputs and outputs. A permission layer gates filesystem, network, process, and environment access, with network egress denied by default.

It speaks the Agent Client Protocol over JSON-RPC on stdio, which is how it hosts existing coding agents. The registry lists Pi, Claude Code, Codex, and OpenCode as built-in, plus a path for custom agents. Installation is npm install @rivet-dev/agentos @agentos-software/pi, and you can run it locally with npx rivetkit dev or deploy to Rivet Cloud.

The benchmark numbers, and where they come from

Rivet's performance page publishes the methodology, which is more than most projects do. Cold start is measured from requesting an execution to first code running, as a median of 10,000 runs on a 12th Gen Intel i7-12700KF with Node.js v24.13.0 on Linux. agentOS lands at 4.8 ms p50, 5.6 ms p95, and 6.1 ms p99. The comparison baseline is E2B at 440 ms p50, described as the fastest mainstream sandbox provider as of March 30, 2026. That ratio is 92x, not the 50x the voiceover states. The video's on-screen text uses the cost figure instead and reads "250x cheaper than sandboxes."

Memory is measured against Daytona, described as the cheapest mainstream provider on the same date. A simple shell command uses roughly 22 MB in agentOS versus Daytona's ~1024 MB minimum, which produces the 47x figure. A full Pi coding agent session uses roughly 131 MB, so the same comparison for a realistic agent workload is closer to 8x.

Cost follows the same pattern. For a full coding agent on AWS ARM, Rivet reports $0.00000058 per execution-second, which it calls 32x cheaper than Daytona. Move the same agent to Hetzner ARM and it reports 281x. Drop to a simple shell command on Hetzner and it reports 1,738x. The headline 254x sits inside that range, and it is not the number you get for running a coding agent on AWS. Rivet's own page says to measure on your target hardware before quoting a cost ratio.

The comparison is partly an accounting change

The cost multipliers assume you provision your own hardware at 70% host utilization and run one agent per sandbox on the baseline side. Sandbox providers bill per VM-second and absorb the idle capacity, the provisioning, and the operational burden. agentOS moves that cost onto you, where it shows up as servers you bought and a utilization number you have to actually hit.

The benchmark hardware is also a desktop CPU, an i7-12700KF with 64 GB of DDR4, rather than a cloud instance. Desktop silicon usually posts better single-thread numbers than shared cloud vCPUs, so treat 4.8 ms as a ceiling for your own deployment rather than a figure to plan against.

The security framing deserves a harder look

The video opens by saying that running agents in the cloud securely normally requires a sandbox, then presents agentOS as the alternative. That skips over what changes. A sandbox provider puts a full Linux environment, and usually a microVM boundary, between agent-generated code and anything you own. agentOS puts the agent inside your backend process, where the boundary is V8's isolate model plus WebAssembly plus the permission layer.

That boundary is real and widely deployed, and the default-deny network egress is a sensible posture. It is also a smaller blast radius than a separate VM, and a sandbox escape lands in the process holding your database connections. Rivet's answer is the permission system and the bindings model, which never hands the agent your credentials. Whether that trade is acceptable depends on how much you trust the code your agent generates, and the video does not raise the question.

Sandbox mounting is the honest part

Isaac's point that you can attach a sandbox for native binaries is accurate and it is the feature that makes the project practical. agentOS ships @rivet-dev/agentos-sandbox, which runs a full Linux sandbox alongside the VM and projects its filesystem into the VM as a native directory. The agent reads and writes through the same fs APIs while the sandbox handles execution. Documented providers include E2B, Daytona, Vercel, Cloudflare, Modal, Docker, and local execution.

Rivet labels sandbox mounting as beta. The use cases it names are browsers, native compilation, and dev servers, which covers a lot of what people currently run coding agents for. If your agent shells out to a compiler or drives a headless browser, you are running both systems rather than replacing one with the other.

Context the video leaves out

agentOS launched April 4, 2026, reached v0.2 on June 25, and added a package registry on July 6. Rivet is a Y Combinator company backed by a16z Speedrun, and agentOS sits next to its other products, Actors and Workflows. Running each VM as a Rivet Actor is what adds persistence, sleep and wake, and orchestration, which points the adoption path toward Rivet Cloud even though the library itself is Apache 2.0 and self-hostable.

The closing claim, that this or some version of it is how 99% of agents will be run, is a prediction and there is nothing to check it against. The project is five months old at the time of the video.

Key Takeaways

  • agentOS is a real Apache-2.0 project at github.com/rivet-dev/agentos, written primarily in Rust, with 4,645 stars and active commits as of September 19, 2026.
  • The video's "250x cheaper" matches Rivet's README banner of 254x, but Rivet's own performance page reports 32x for a full coding agent on AWS ARM. The large multipliers require a trivial shell workload or Hetzner hardware.
  • The voiceover's "50 times faster" does not match any published figure. Rivet claims 92x faster cold starts, 4.8 ms p50 against E2B's 440 ms.
  • Benchmarks were run on a desktop i7-12700KF against baselines captured March 30, 2026, and Rivet tells readers to measure on their own hardware before quoting ratios.
  • The security story changes rather than improves. Isolation moves from a separate VM to V8 isolates and WebAssembly inside your own backend process, backed by a default-deny permission layer.
  • Sandbox mounting is documented and supports E2B, Daytona, Vercel, Cloudflare, Modal, and Docker, but Rivet marks it beta.
  • Unverified: I could not confirm the npm download counts or that the 4,645 stars belong to agentOS alone. The GitHub repo was created February 7, 2024, more than two years before agentOS launched, which suggests the repository was repurposed, though I found no direct confirmation of that.

Resources

Published September 1, 2026. Writeup generated from a favorited TikTok.