Summary: AWS introduced Lambda MicroVMs on June 22, 2026 as a serverless primitive for isolating untrusted code in use cases such as AI coding assistants and vulnerability scanning. Each job gets its own kernel and resources, Firecracker snapshots enable fast resume, and current limits include a maximum eight-hour run, 16 vCPUs, 32 GB of memory and disk, and ARM64-only support.
On June 22, 2026, AWS took to its official news blog to introduce the newest member of the Lambda lineup: Lambda MicroVMs. This serverless compute primitive exists to run untrusted code in isolation, and the announcement lists its four intended use cases outright — AI coding assistants, interactive coding environments, data analytics platforms, and vulnerability scanning services. All four share an awkward requirement: each user and each job needs a sandbox to itself, which is exactly where traditional architectures have always stumbled.
AWS frames the old situation as a forced choice between “isolation, speed, and state retention.” The point of MicroVMs is to make that choice disappear.
Isolation, Speed, or State — Pick Your Compromise
Every legacy option falls short somewhere. Virtual machines isolate best but take minutes to boot; containers come up fast, yet their shared-kernel design demands heavy hardening before they can be trusted with untrusted code; FaaS is built for request-response loads and cannot sustain a long interactive session that has to keep its state. A product meant to let people write and run code in the same sitting ends up compromising no matter which of the three it picks.
MicroVMs instead assigns every user or job a MicroVM of its own — kernel shared with nobody, resources shared with nobody — so if something goes wrong, the damage stops at that single instance. It is precisely the guarantee AI coding assistants need: code a model writes can be wrong, or even hostile, and it must never reach the users running alongside it.
How Firecracker Snapshots Deliver Instant Starts
Beneath it all sits Firecracker, the lightweight virtualization technology that already backs Lambda Functions and that, according to AWS, handles more than 15 trillion function invocations per month. The operating pattern is to build an image first and launch from it later: you hand over a Dockerfile plus your code zipped up in Amazon S3; the service builds the image, runs application initialization, and captures a Firecracker snapshot of the memory and disk state. From then on, every MicroVM comes back from that snapshot instead of cold-booting — even sessions several gigabytes in size start near-instantly. Build logs stream to CloudWatch.
The spec sheet: one MicroVM runs for at most 8 hours and can carry up to 16 vCPUs, 32 GB of memory, and 32 GB of disk. For now, ARM64 is the only supported architecture.
Lifecycle: Suspend, Resume, and Reaching the Sandbox
State retention is the other marquee feature. A suspended MicroVM takes its memory, disk, and processes with it — installed packages, loaded models, and in-progress files all come back exactly as they were. Pausing can be issued explicitly through the API or left to an idle policy; the official demo set a 900-second idle threshold with auto-resume switched on, and from the client side the transition is essentially imperceptible.
There is no networking setup to speak of: once launched, every MicroVM receives a dedicated HTTPS endpoint, and requests are authenticated with a short-lived token carried in the X-aws-proxy-auth header. The What’s New post notes the endpoint handles HTTP/2, gRPC, and WebSockets, and that MicroVMs can be managed from the Lambda console, CloudFormation, CDK, or the Agent Toolkit. Billing combines a baseline compute charge for the time a MicroVM is running with extra charges only for active stretches beyond that baseline; pausing an idle MicroVM trims cost without sacrificing state.
One wrinkle deserves attention: instances resume from a snapshot taken after pre-initialization, so applications that generate unique content or open network connections during initialization may need the service-provided hooks. The launch spans five regions: US East (N. Virginia and Ohio), US West (Oregon), Europe (Ireland), and Asia Pacific (Tokyo).
Why Agent Developers Should Care
AWS casts the new primitive as a complement rather than a replacement: Lambda Functions stay on as the event-driven backbone, steps that require isolated execution of untrusted code get handed to MicroVMs, and the two can call each other. For teams putting an agent toolchain together, code execution now comes as a fully managed option — no more operating your own Firecracker fleet or hardening a container environment by hand.
Two boundaries should be weighed up front. ARM64-only support means anything relying on x86 packages must be ported first, and the 8-hour ceiling rules out resident services with longer lifetimes. Against the “one clean sandbox per task” execution pattern agents favor, though, neither limit bites — what counts is that suspend/resume and the dedicated endpoint compress a stretch of infrastructure that used to be self-built into a single API call.