Vercel's Sandbox Now Preinstalls Claude Code and Codex by Default

Vercel Sandbox, the ephemeral compute primitive Vercel built for running untrusted and AI-generated code, dropped its fixed Node and Python runtimes for a set of versioned, open-source “Managed Images.” The new default image ships four coding agents already installed. Starting with version 3 of the Sandbox SDK, every new sandbox boots from vercel/sandbox/universal:latest unless told otherwise (Vercel changelog, “Vercel Sandbox now runs on Vercel Managed Images,” Aug 10, 2026).

---

How it works

The universal image is a rolling release on Ubuntu 26.04: Node.js 24, Python 3.14 with uv, and four terminal coding agents baked in (opencode, Claude Code, Codex and pi), alongside git, vim, nano, tmux, ripgrep, jq and fzf (Vercel changelog, Aug 10, 2026). Teams that don’t want the full agent-and-utility bundle can pick a narrower managed image instead: node22, node24 or node26 on the same Ubuntu 26.04 base, python3.14, a minimal Ubuntu image, or an Arch Linux image with no Node.js or Python preinstalled at all (Vercel docs, “Images”).

Every managed image gets a nightly build, and the Dockerfiles behind them are public in the vercel/sandbox GitHub repo. Rolling tags like latest and the major-version tags pick up OS and dependency patches automatically, including new releases of the coding agents themselves. That’s convenient for a throwaway sandbox and less convenient for a job that needs to behave the same way twice. Vercel says dependencies are pinned to specific versions within a given image release, and a team that needs a fully immutable environment can pin to an image digest directly, vercel/sandbox/universal@sha256:..., rather than trust a moving tag (Vercel docs, “Images”). Custom environments are still fully supported outside the managed set: push any OCI image to Vercel Container Registry and boot a sandbox straight from it with Sandbox.create({ image: 'my-repository:latest' }) (Vercel docs, “Working with Sandbox”).

---

Why this matters

Vercel Sandbox exists to run code Vercel doesn’t trust yet: AI-generated code, an agent’s shell commands, a user’s untested script, inside an isolated, disposable environment (vercel/sandbox on GitHub). Making Claude Code, Codex and opencode part of that box’s factory settings is Vercel reading its own usage pattern back to developers: people were already scripting agent installs into custom sandbox images by hand. Projects like rivet-dev/sandbox-agent, built explicitly to run Claude Code, Codex, OpenCode or Amp inside a sandbox and control them over HTTP, and Herdr, a tmux-style manager that gives each agent its own Vercel Sandbox pane, show the pattern was already common enough to build tooling around (rivet-dev/sandbox-agent on GitHub; Vercel changelog, “Give every agent in Herdr its own Vercel Sandbox”). Vercel just made that the zero-config path.

It’s also a bet that “coding agent” belongs in the same default toolbox as git and vim, not as an opt-in extra. That’s a reasonable call for a sandbox product whose whole pitch is running agent workloads safely, but the default image is now heavier and carries more attack surface than the old bare-runtime containers did. Anyone using Sandbox purely to execute short-lived, non-agent jobs should factor that in before switching.

---

Key Takeaways

• Vercel Sandbox’s new default image, vercel/sandbox/universal:latest, runs Ubuntu 26.04 with Node.js 24, Python 3.14 and four coding agents preinstalled: opencode, Claude Code, Codex and pi.
• New sandboxes default to this image starting with Sandbox SDK v3; narrower managed images (bare Node versions, Python-only, minimal Ubuntu, Arch) are still available for teams that don’t want the agent bundle.
• Rolling tags auto-update OS packages, language runtimes and agent versions nightly. Pin to a specific image digest for a reproducible build instead of trusting latest.
• Fully custom OCI images via Vercel Container Registry remain the escape hatch for anything the managed set doesn’t cover.

---

What to do

If a project already spins up Vercel Sandboxes to run Claude Code or another terminal agent, drop the custom install step from your image build and let the universal default handle it. For anything running in production against a fixed dependency set, don’t leave it on latest. Pin the image digest now, before a nightly rebuild changes an agent version or a system package under you without warning.