Northflank vs Blaxel: AI sandboxes, pricing, and infrastructure compared

Northflank and Blaxel both provide isolated sandbox environments for AI agents and untrusted code execution. Northflank integrates sandboxes and microVM-backed isolation into a broader application and AI infrastructure platform, while Blaxel focuses on persistent sandbox environments. On September 10, 2026, Baseten acquired Blaxel.

Northflank has run production microVM sandbox orchestration since 2021, with isolated execution built into its multi-tenant platform. Today, Northflank Sandboxes and Cloud Harnesses provide isolated environments for AI agents and development, while the same control plane can run the services, jobs, databases, GPUs, and other workloads those agents generate. This comparison looks at how Northflank and Blaxel differ across isolation, lifecycle, startup and scaling, networking, GPUs, the full agent execution stack, infrastructure control, security, observability, and pricing.

AI agents increasingly do more than execute a single piece of code. An agent can create an API, start a worker, run a database migration, provision a database, execute background jobs, download data, or deploy an application. Those workloads are generated by the agent, so they should be treated as untrusted too.

Northflank treats sandboxing as a security boundary around the entire workload. Cloud Harnesses provide an isolated environment for agents to work in, while Sandboxes, services, jobs, databases, volumes, networking, and GPUs can run through the same control plane. This means you can isolate both the agent and the infrastructure it creates, from development through production.

Blaxel focuses on persistent microVM sandbox environments for agent execution. That provides isolated compute with persistent state, but the resulting application infrastructure still needs somewhere to run. With Northflank, the sandbox is not the destination. It is the security boundary around the entire agent-generated workload.

Product and plan details are current as of September 2026.

Both platforms use microVM-based isolation to separate sandbox workloads from the underlying host. Blaxel provides a microVM for each sandbox, while Northflank uses Kata Containers with Cloud Hypervisor as its primary microVM-based isolation approach. Northflank also supports Firecracker and gVisor.

Northflank has used microVM-based sandbox orchestration in production since 2021. Because sandboxing is part of the underlying multi-tenant infrastructure, the same isolation model can be applied to agent environments as well as the services, jobs, and other workloads those agents create.

Blaxel's model is centred on the individual sandbox. Its persistent environments preserve state between executions, making the sandbox itself the primary execution boundary. Northflank extends that boundary across the application stack.

Blaxel sandboxes are designed to persist. Sandboxes can enter standby after inactivity and resume quickly while preserving memory and process state. Blaxel also provides persistent storage through volumes and Agent Drive.

Northflank supports a different lifecycle model. Sandboxes and application workloads can be created, started, scaled to zero, restarted, and destroyed, while persistent volumes can retain data independently of the compute lifecycle. Templates and Workflows can reproduce the surrounding infrastructure when a new environment is required.

This distinction matters when an agent's work extends beyond a single sandbox session. Northflank can persist the data that needs to persist while independently managing the lifecycle of the application, workers, jobs, databases, and other infrastructure around it.

Northflank Sandboxes can start in under one second, while Northflank can also scale application workloads horizontally as demand changes. Its infrastructure supports container images, Dockerfiles, Buildpacks, registries, node pools, placement controls, and BYOC infrastructure.

Blaxel provides fast resume from standby, with resume times below 25 milliseconds, as well as sandbox forking and prebuilt environments. These capabilities are designed around quickly creating or resuming isolated agent environments.

The difference is the scope of what is being scaled. Northflank can scale the sandbox alongside the application infrastructure around it, including services, workers, jobs, databases, and GPU workloads.

Northflank Sandboxes use ephemeral root filesystems by default, with persistent volumes available when state needs to survive the sandbox lifecycle. Sandboxes can connect to other workloads through private networking, DNS, public and private ports, and network policies. This allows an isolated agent environment to interact with the databases and services it needs without putting those workloads on the public internet.

Northflank also supports GPU Sandboxes and GPU workloads across managed cloud and BYOC infrastructure, including GPUs such as H100, H200, A100, L4, L40S, and B200. This allows the same infrastructure platform to run agent execution, model workloads, and production applications.

Blaxel provides persistent filesystem and volume options, sandbox networking, and proxy access. Blaxel does not support GPU Sandbox.

Northflank supports Git-based deployments, Dockerfiles, Buildpacks, external registries, Templates, Workflows, APIs, CLI and SDKs. Northflank Skills extend this workflow to tools such as Claude Code, Codex, Cursor, and OpenCode, while Cloud Harnesses provide isolated development environments for AI coding agents.

Blaxel provides SDKs, API, CLI, and MCP integrations. Agents can create and interact with sandbox environments directly through these interfaces.

The distinction is less about whether developers can create a sandbox and more about what happens after the sandbox is created. Northflank connects agent execution directly to the infrastructure needed to build, deploy, and run the resulting application.

A sandbox is useful for testing code in isolation, but AI-generated applications often need more than an execution environment. A typical agent-generated application can include an API service, worker, database, scheduled job, persistent volume, and networking between those components.

Northflank full-stack preview environments and preview blueprints can reproduce that complete application topology for each change. The same platform can then run the resulting workloads in production, with the isolation, networking, storage, observability, and scaling controls used throughout the lifecycle.

Blaxel provides isolated sandbox execution rather than an equivalent full-stack application preview and production platform. For teams building agent-generated applications, this means the sandbox and the infrastructure running the resulting application are separate concerns.

Northflank supports self-service BYOC deployments across providers including AWS, GCP, Azure, Oracle, CoreWeave, Civo, and Nebius. Teams can run Northflank infrastructure in their own cloud accounts while retaining the Northflank control plane and deployment experience.

Northflank also supports eligible existing Kubernetes clusters through BYOK, including infrastructure running across cloud, on-premises, and bare metal environments. This gives teams control over where workloads and data run without giving up the platform layer used to manage them.

Blaxel primarily provides managed infrastructure, with BYOC available through its Custom offering. Northflank provides self-service BYOC across multiple cloud providers as well as BYOK and has been doing this since 2019.

Northflank combines workload isolation with platform-level security controls. Organisations can use granular RBAC, SAML and OIDC SSO, audit logs, policy controls, and enterprise deployment options. Logs and metrics are available across services, jobs, builds, and other infrastructure, giving teams visibility beyond the sandbox itself.

Blaxel provides security and compliance capabilities around its sandbox infrastructure, alongside sandbox logs and resource metrics. Its isolation model provides a dedicated execution boundary for each sandbox.

For agent infrastructure, isolation is only one part of the security model. The infrastructure surrounding the sandbox also needs identity controls, auditability, networking policies, secrets management, observability, and production governance. Northflank brings those controls into the same platform used to run the workloads.

Northflank Cloud charges $0.01667 per vCPU hour and $0.00833 per GB hour for memory, billed per second. BYOC uses a separate platform pricing model, with cloud infrastructure billed directly by the underlying provider.

Blaxel uses fixed sandbox memory tiers, with pricing ranging from its XS tier at $0.0828 per hour for 2 GB of memory to its XL tier at $1.3248 per hour for 32 GB. Its 4 GB tier costs $0.1656 per hour. Standby reduces compute charges while storage continues to be billed.

For example, using 200 continuously running 4 GB sandboxes for 720 hours, Blaxel's published 4 GB tier would cost approximately $23,846 per month. A Northflank configuration using 2 vCPUs and 4 GB of memory for the same 200 workloads would cost approximately $9,599 per month based on the published compute rates. That is roughly 60% lower under these assumptions.

The exact cost depends on CPU allocation, memory, storage, GPU usage, standby behaviour, and infrastructure model. The broader difference is that Northflank pricing covers the compute primitives used across the application stack, rather than requiring a separate platform for sandbox execution and another platform for the application infrastructure around it.

Blaxel is focused on persistent sandbox infrastructure for AI agents, with microVM isolation, persistent state, standby and resume, storage, and networking.

Northflank is designed for teams that need the sandbox and the infrastructure around it. Agents can work inside isolated environments, while the services, workers, jobs, databases, GPUs, previews, and other workloads they create can run through the same platform.

The key difference is where the platform boundary ends. With Blaxel, the sandbox is the primary product. With Northflank, the sandbox is one infrastructure primitive within a broader application and AI platform, allowing teams to manage the agent, its execution environment, and the workloads it produces through the same control plane.

Blaxel focuses on persistent microVM sandbox environments for AI agents. Northflank provides sandboxing as part of a broader application and AI infrastructure platform that also includes services, jobs, databases, GPUs, networking, previews, and production infrastructure.

Yes. Northflank can provide isolated sandbox environments for AI agents while also providing the infrastructure needed to run the applications and workloads those agents create.

Yes. Baseten acquired Blaxel on September 10, 2026.

Yes. Blaxel offers Bring Your Own Compute through its Custom offering. Northflank provides self-service BYOC across multiple cloud providers as well as BYOK for eligible existing Kubernetes infrastructure and has been doing this since 2019.

Both platforms provide security and compliance capabilities around isolated workloads. Northflank additionally provides platform-wide controls including granular RBAC, SSO, audit logs, networking controls, and enterprise deployment options across the workloads managed by the platform.