Why every AI agent should run on its own VM

When you give an AI agent the ability to run code, read files, browse and send email, you are handing it real power. The question is how to do that safely. The answer most production teams land on is simple: one isolated VM per agent.

The four reasons

• No cross-tenant leakage. Your agent never shares memory or disk with anyone else's. Its data stays its data.
• Blast-radius control. If a task misbehaves or a prompt goes wrong, the impact is contained to that single machine.
• Predictable resources. Dedicated CPU, memory and disk — not a noisy shared pool that slows down at the worst moment.
• Agent-specific tools. Install exactly what this agent needs and nothing more, keeping its surface area small.

Isolation is a proven pattern

Dedicated containers and VMs became the standard for production workloads precisely because isolation prevents one workload from harming another. Autonomous agents — which take actions, not just compute — need that isolation even more.

Keep the keys off the agent

A dedicated VM pairs well with another rule: secrets stay off the machine the agent controls. On minion.sg, frontier-model API keys live on the platform, never on the VM. The agent can do real work while sensitive credentials stay out of reach.

This is the core of managed agentic hosting: every minion gets its own private VM, sandboxed, with keys held safely off-box. See how it works.