Vercel Sandbox now supports multiple Linux users and groups in one Sandbox. That sounds like a small operating-system feature, but it changes the shape of multi-agent work.
Each agent can run as its own user with a private home directory. Commands and file operations execute under that user’s permissions, and users cannot read, write, or list each other’s files. When agents need to collaborate, the Sandbox can create a group and add the relevant users to a shared directory.
The source example is direct:
const sandbox = await Sandbox.create();
const coder = await sandbox.createUser("coder");
const reviewer = await sandbox.createUser("reviewer");
const cmd = await coder.runCommand("whoami");
console.log(await cmd.output());
await sandbox.createGroup("project");
await coder.addToGroup("project");
await reviewer.addToGroup("project");The practical pattern is clear: a coder agent, reviewer agent, test agent, or migration agent can share the same base environment without sharing every private file by default. Collaboration becomes an explicit group boundary instead of a social convention inside one broad workspace.
New Runtime Read
Multi-agent systems need normal isolation primitives, not only orchestration prompts. Separate users and shared groups make the runtime itself express who can touch what.
This does not turn one Sandbox into a complete security boundary for every threat model. It does make a useful product statement: agent platforms are adopting operating-system permissions as part of the developer API. That is the right direction for running several autonomous workers in the same task environment.