VMs Powering Mobile Agents: Instinct & Claude Code

What Happened

Instinct and Claude Code now run their mobile agents inside dedicated virtual machines (VMs). Instead of executing agent logic directly on the host or in a serverless function, the agent’s code, dependencies, and runtime are packaged into a VM image that can be spun up on demand.

The change comes from a need for stronger isolation, predictable performance, and easier compliance with enterprise security policies. By containerizing the agent inside a VM, the platforms can bundle all required libraries, manage resource limits, and provide a clean reboot cycle whenever an agent needs to be restarted or upgraded.

Why This Matters for Builders

• Isolation and Security: VMs create a hardened boundary between the agent’s execution environment and the host system. The risk of privilege escalation drops, and auditing the agent’s behavior becomes easier.
• Consistent Performance: VMs allocate CPU and memory predictably. This is critical for time‑sensitive workflows such as real‑time data processing or latency‑critical API calls.
• Compliance Friendly: Enterprises that require strict data residency or audit trails can satisfy those requirements more readily when agents run in controlled VM images.
• Simplified Upgrades: Updating an agent’s dependencies or patching a security flaw can be done by rebuilding the VM image and redeploying, without touching the underlying host or orchestrator.
• Scalability: Encapsulating the agent runtime lets you spin up multiple VMs behind a load balancer or orchestrator (e.g., Kubernetes) to handle traffic bursts.
• Operational Overhead: VMs consume more resources than containers and take longer to start. Builders must balance the need for isolation against the latency of VM boot times.

FAQ

Q: Will this increase latency for my agent workflows?

A: VMs boot slower than containers, but many platforms now offer fast‑boot images and pre‑warm pools, which can keep the impact minimal.

Q: How do I manage secrets inside a VM‑based agent?

A: Most platforms expose secure secret injection mechanisms that mount encrypted files or environment variables into the VM at launch, keeping secrets out of the image.

Q: Can I still use serverless functions for lightweight agents?

A: Yes. The VM approach suits agents that need heavy dependencies or strict isolation. Lightweight, stateless tasks can still run in serverless environments to keep costs low.

Originally published on Automations Cookbook.