// HACKER NEWS — CYBERSECURITY
The VMs Powering Mobile Agents (Instinct, Claude Code)
One awesome product evolution is that agents (Claude Code, Instinct, Poke, etc) are moving off our local computers so that we can use them on our phones.
Ultimately this is great for the customer because that means the agent companies provide us with VMs for them to run on! Here's some notes on how the major platforms work based on looking around on ws-term.
Claude Code's box is its own Firecracker microVM, a KVM guest with its
own kernel, booted straight into an init written in Rust:
process_api is PID 1 and the host's control agent living
inside your VM: it mounts the disks, then listens on vsock port 2024 so the
host can drive the session from outside. That's the platform's defining trait:
the operator lives inside your tenant space, and a lot of engineering goes into
sealing it off (PID 1 is non-dumpable, /proc/1/mem is denied even with
CAP_SYS_PTRACE, your shell is missing CAP_SYS_RESOURCE).
The disks split cleanly into yours (writable, persistent) and theirs
(read-only, shared):
The harness is the thing running your tool calls and is a 324 MB compiled Bun
binary on a read-only disk. The model runs elsewhere; inference goes out as Server-Sent Events over HTTPS/2 (not a WebSocket) to /v1/messages, through an egress gateway that is 443-only and
MITM'd (CN = Egress Gateway ... (production)), with api.anthropic.com pinned
in /etc/hosts. There is no inbound at all (192.0.2.2, an RFC-5737 test
address). Auth is a host-minted OAuth token, cached root-only on disk and
rotated per boot.
Lifecycle is host-driven and measured from the inside: ~430 ms to init,
~6.4 s to the harness process. Spin-up is triggered by an inbound message
(the host wakes the VM over vsock and runs --session-mode resume); spin-down is
idle reclaim decided by the host. When it's reclaimed, the processes die but
vda detaches intact and reattaches on the next cold boot, which is why the
conversation feels continuous even though the compute was destroyed.
Instinct is a new startup which launched recently and it does some very nice things on the memory side which gives that feel of it being a real assistant rather than a chatbot.
e2b.local means Instinct doesn't operate its own VM fleet; it rents
E2B sandboxes ("sandbox-as-a-service"), a throwaway Ubuntu box
you hand an agent so it has a computer:
pci=off + virtio-over-MMIO + empty DMI + tap0 networking is the Firecracker
signature: no PCI bus, no SMBIOS, minimal devices. So both apps sit on the
same microVM; the difference is who runs the fleet and what boots inside it.
Where Claude Code boots a stripped custom init (process_api as PID 1), E2B boots a
full Ubuntu with systemd and a whole XFCE desktop:
~1.26 s to cold-boot all the way to a graphical desktop. The operator-in-guest exists
here too, but it's just E2B's envd running as an ordinary systemd service, not a
sealed PID 1. E2B sandboxes are configurable too (you pick the vCPU, RAM, disk, and idle
timeout, and whether the box can be paused and resumed from a memory snapshot instead of
cold-booted); Instinct runs a modest 2 vCPU / 1.9 GB desktop template.