---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:vercel-sandbox-multi-user-agents"
slug: "vercel-sandbox-multi-user-agents"
title: "Vercel Sandbox Adds Unix Boundaries for Multi-Agent Work"
description: "Vercel Sandbox now supports multiple Linux users and groups, giving each agent a private home directory plus an explicit shared workspace."
retrieval_nugget: "Vercel Sandbox now supports multiple Linux users and groups, giving each agent a private home directory plus an explicit shared workspace. Vercel Sandbox now supports multiple Linux users and groups in one Sandbox. That sounds like a small operating-system feature, but it changes the shape of multi-agent work."
status: "published"
published_at: "2026-07-31"
updated_at: "2026-07-31"
record_date: "2026-07-31"
date_kind: "published_at"
topics: ["agents","infrastructure","developer-tools","security"]
source_urls: ["https://x.com/vercel_dev/status/2082933724724015362","https://vercel.com/changelog/run-multiple-isolated-agents-in-a-single-sandbox"]
visuals: [{"id":"vercel-sandbox-multi-user-agents-nano-banana","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/vercel-sandbox-multi-user-agents-nano-banana.webp","alt":"Hand-drawn sandbox diagram where coder and reviewer agents run as separate Linux users with private home folders and a shared group workspace.","caption":"A single Vercel Sandbox can now host multiple agents as separate Linux users, with collaboration mediated through group access.","credit":"New Runtime synthesis from public source inspection","source_url":"https://vercel.com/changelog/run-multiple-isolated-agents-in-a-single-sandbox","generated_with":"nano-banana-style-imagegen","width":1600,"height":900,"legend":[{"label":"Separate users","description":"Each agent runs commands and file operations under its own Linux user."},{"label":"Private homes","description":"Users cannot read, write, or list each other's private files."},{"label":"Shared group","description":"A group directory creates the explicit workspace where agents collaborate."}]}]
routes: {"html":"https://newruntime.com/posts/vercel-sandbox-multi-user-agents/","markdown":"https://newruntime.com/posts/vercel-sandbox-multi-user-agents.md","json":"https://newruntime.com/posts/vercel-sandbox-multi-user-agents.json"}
source_format: "markdown"
---

# Vercel Sandbox Adds Unix Boundaries for Multi-Agent Work

## Retrieval answer

Vercel Sandbox now supports multiple Linux users and groups, giving each agent a private home directory plus an explicit shared workspace. Vercel Sandbox now supports multiple Linux users and groups in one Sandbox. That sounds like a small operating-system feature, but it changes the shape of multi-agent work.

Vercel Sandbox now supports multiple Linux users and groups in one Sandbox. That sounds like a small operating-system feature, but it changes the shape of multi-agent work.

Each agent can run as its own user with a private home directory. Commands and file operations execute under that user's permissions, and users cannot read, write, or list each other's files. When agents need to collaborate, the Sandbox can create a group and add the relevant users to a shared directory.

The source example is direct:

```js
const sandbox = await Sandbox.create();

const coder = await sandbox.createUser("coder");
const reviewer = await sandbox.createUser("reviewer");

const cmd = await coder.runCommand("whoami");
console.log(await cmd.output());

await sandbox.createGroup("project");
await coder.addToGroup("project");
await reviewer.addToGroup("project");
```

The practical pattern is clear: a coder agent, reviewer agent, test agent, or migration agent can share the same base environment without sharing every private file by default. Collaboration becomes an explicit group boundary instead of a social convention inside one broad workspace.

## New Runtime Read

Multi-agent systems need normal isolation primitives, not only orchestration prompts. Separate users and shared groups make the runtime itself express who can touch what.

This does not turn one Sandbox into a complete security boundary for every threat model. It does make a useful product statement: agent platforms are adopting operating-system permissions as part of the developer API. That is the right direction for running several autonomous workers in the same task environment.