Daytona provides secure, elastic, programmatic sandboxes (Linux containers, Linux and Windows VMs, and GPU sandboxes) that AI agents spin up in under ~90ms (vendor claim) to run untrusted AI-generated code in isolated, stateful runtimes with snapshot and fork primitives. It is a managed service with a Bring-Your-Own-Compute option and has been closed source since June 2026. It is an integrated sandbox provider for Anthropic Claude Managed Agents, OpenAI Agents SDK Sandbox Agents and Cognition Devin Outposts, and targets code execution, computer use and RL/eval rollouts.
GitHub shows the repository was archived on 2026-10-03 with about 71.7k stars. The README says core development moved to a private codebase in June 2026 and the repo will get no further updates, fixes or releases. It stays free to use and fork under its license, as is and without support.
Why it matters: This completes the closed-source transition. Self-hosted deployments built on the OSS code are now unsupported.
Daytona ML Researcher Daniel Thi Graviet compared independent retries against branching from full sandbox snapshots on five Terminal-Bench tasks. Independent retry solved 17/25 against 6/25 for snapshot branching. On a custom stateful task (staged-service-repair, SQLite), full snapshot restore solved 4/5, while clean restart and git-diff restore each solved 0/5.
Why it matters: This is in-house research on snapshot and fork primitives for agent search and RL rollouts, and it shows Daytona now employs an ML researcher.
Cursor Cloud Agents can run on Daytona sandboxes through Cursor's Self-Hosted Pools. Each request gets its own Linux container, Linux VM or Windows VM, created from a snapshot and deleted when the worker exits. This requires a Cursor Enterprise team, a service-account API key and a controller on customer-managed hardware.
Why it matters: This is an integration with a major AI coding product that uses Daytona's VM and Windows sandbox classes. The source is Daytona's own blog (a Daytona DevRel author), and Cursor's docs index does not mention Daytona, so treat it as vendor-described.
Yutori released Navigator n2, a computer-use model, with a public playground. Each session gets an isolated Daytona Linux desktop VM pre-booted from a snapshot that uses the OSWorld environment image, with noVNC streaming through signed preview URLs.
Why it matters: This shows Daytona in use for computer-use agent evaluation on OSWorld tasks. The post was written by a Yutori Member of Technical Staff but published on Daytona's blog. Yutori's own pages did not show a Daytona mention, so treat it as co-published or self-claimed.
Daytona Platforms Inc. filed a new Form D on 2026-08-17. It reports $48,274,000 of equity sold to 6 investors out of a $60M total offering, with a first sale on 2026-07-31 under Rule 506(b). Listed related persons are Ivan Burazin (executive officer and director), Vedran Jukic, Kevin Zhang and Matt Turck (directors). There is no company press release, and no lead investor or valuation is disclosed. AlleyWatch's 2026-08-17 funding report covers the $48.3M raise without naming a stage. The notacompany aggregator calls it a $48M Series B.
Why it matters: This comes about six months after the $24M Series A and more than doubles disclosed capital, a strong scale signal in a competitive sandbox market. The round stage, lead investor and valuation are not publicly confirmed.
Daytona's Trust Center lists a SOC 2 Type II report from Insight Assurance, issued 2026-07-28. It covers 2025-12-16 to 2026-03-15 for Security, Availability and Confidentiality, with an unqualified opinion, and is scoped to the Daytona AI Runtime Platform. It adds to the earlier Type I. The full report is available on request.
Why it matters: Moving from SOC 2 Type I to Type II removes a common enterprise procurement blocker. This is vendor-hosted and was not checked against the auditor.
Daytona's blog, by Daniel Thi Graviet, discusses CRAB (Checkpoint-and-Restore for Agent SandBoxes), an HKUST paper (arXiv 2604.28138) that uses eBPF to checkpoint only recovery-relevant state. The paper reports up to 87% less checkpoint traffic and 100% recovery correctness. The paper is by HKUST researchers, not Daytona.
Why it matters: It shows Daytona positioning its snapshot primitives for long-horizon agent recovery and rollout infrastructure.
Anchor Browser's hardened Chromium, with managed VPN and auth layers, is integrated with Daytona's isolated sandboxes for enterprise browser agents. The post is written by Anchor's CEO and co-founder, Idan Raman, and published on Daytona's blog.
Why it matters: This extends Daytona into browser-agent workloads through a partner. It is a partnership, not a disclosed customer.
Devin can now run its tool calls in Daytona sandboxes instead of Cognition-hosted machines through Devin Outposts. Cognition keeps the agent loop. This requires Devin Enterprise. Cognition's own Outposts docs list Daytona as a partner integration (Linux and Windows sandboxes).
Why it matters: This is an integration with a major AI coding-agent vendor, confirmed on Cognition's own docs. It is an integration, not a disclosed customer contract.
Brainbase's Universal Harness API runs multiple coding-agent harnesses (Claude Code, Codex, OpenCode and others) through one endpoint, with Daytona as the default isolated sandbox. The source is Daytona's blog.
Why it matters: This is another agent-platform integration, self-described by Daytona.
Daytona ran 46 OSWorld Windows tasks (Excel, Word, PowerPoint and multi-app) on its Windows sandboxes. Claude Opus 4.6 averaged 31.54% and GPT-5.4 averaged 29.13%. A sandbox was created from the snapshot in 10.5s and the desktop was ready in about 32s. A reproducible fork is provided.
Why it matters: This shows Windows computer-use evaluation running on Daytona without manual VM setup. It is a vendor-run evaluation and not peer-reviewed.
Daytona ML Researcher Daniel Thi Graviet reports about 1.1s median startup for diverse snapshot-based sandboxes, compared with 4.2-4.4s on Kubernetes.
Why it matters: This is a vendor-run infrastructure comparison relevant to many-environment RL and eval workloads. It is a vendor claim and not peer-reviewed.
Daytona moved its production codebase to a private repo, citing AI-driven vulnerability discovery and the risk of publishing the code behind its isolation boundary. The existing public repo stays accessible but is no longer maintained. SDKs, docs and ongoing public work move to github.com/daytona.
Why it matters: Buyers who planned to self-host the AGPL open-source stack now need managed or Bring-Your-Own-Compute deployment. This changes the open_source and license fields.
The changelog adds a Windows sandbox class and GPU type selection (v0.184.0, 2026-06-03). Snapshot and fork reached Windows in v0.186.0 (2026-06-10). Earlier releases added a dedicated physical GPU per sandbox (v0.181.0, 2026-05-25) and GPU region quotas plus organization webhooks (v0.179.0, 2026-05-21).
Why it matters: Daytona is expanding beyond Linux containers into Windows desktops for computer-use agents and GPU sandboxes. Current open roles focus on GPU and Windows sandbox teams.
| Date | Round | Amount | Led by | |
|---|---|---|---|---|
| 17 Aug 2026 | undisclosed | $48.274M | – | source ↗ |
| Undisclosed equity round (the SEC filing says only 'Equity'; one aggregator, notacompany, labels it a $48M Series B; there is no company announcement) · $48.274M equity sold of a $60M total offering (SEC Form D new notice filed 2026-08-17; first sale 2026-07-31; 6 investors; Rule 506(b)) | ||||