Making /workspace needs permission to write files
files:mkdir on / or /workspace now needs a key that may write files, as on any other path, and a key that may only read is refused. If the path exists but is not a folder, it answers 409 not_a_directory instead of success. See Files.
A public preview's warning cannot be skipped from a link
In browsers that do not say where a click came from, only the warning's own Continue button now takes a visitor past it. A link sent by someone else shows the warning first. See Networking.
Image rebuilds get the newest base image
A build FROM python:3.12-slim or :latest now starts from the image the tag names today, as docker buildx build does, instead of an earlier pull kept from a past build. cache: false (--no-cache) now always builds every step afresh. See Faster rebuilds.
Comparison tables that read cleanly
The tables on the comparison, blog and how-to pages are soft rounded cards again, with room around the text instead of a hard square outline, and Runtime's row in a price ranking is one even band. See compare sandboxes.
Best sandbox for AI agents, compared
A new page ranks every sandbox provider by the cost of the same agent job, sets their published start times beside ours, and names which one fits each need, GPUs and self-hosting included. The price index now opens on which agent sandbox is cheapest. See Best sandbox for AI agents.
Faster first paint on the website
Guides, blog posts, comparisons, pricing and the home page now load only their own styles: a glossary page fetches 30 KB of them instead of 67 KB, the home page 25 KB instead of 61 KB.
A worker's own workers share its daily limit
When a key with a daily limit makes keys, the limits of every live key under it, at any depth, now add up to at most its own, so a worker cannot multiply its cap by making workers of its own. Keys are made at most 8 deep, and a key in a compartment makes no keys. See Run a swarm.
A wallet account's key is never lost to a failed save
If runtime_wallet_claim cannot save the key it was just issued (a read-only config directory, say), it still connects and shows the key once, to keep.
A command on a paused sandbox starts sooner
An exec, a file call or any other command sent to a paused sandbox with autoWake wakes it with two fewer steps before the command runs. A key that may run commands but not read the sandbox is still refused before anything wakes, as before. See Wake on request.
Cost breakdowns you can read at a glance
The worked sums on the comparison, blog and use-case pages, such as "Cost for the same job", now show as one card per provider with its total and a bar to scale, instead of text in a code box. The blog, how-to guides, glossary, pricing and changelog pages share the cleaner look of the sandbox page. Each page's Markdown is unchanged for agents. See Runtime vs E2B.
MCP servers at a URL that never expires
public: true on sbx.mcp.start (public=True in Python, Public in Go, --public in the CLI, public on POST /v1/sandboxes/{id}/mcp and the runtime_sandboxes_mcp tool) serves the sandbox's MCP servers at a public preview: URLs with no link token, so an agent is set up with them once. The Authorization header still guards every request, and stays the same at every start, after a restart too, until you stop the gateway. An idle sandbox pauses with its servers in memory and wakes on the next request. Reading the gateway no longer turns a public preview of its port back to private. Needs a kept top-up. See MCP servers.
The console stays fast for busy accounts
Home, Usage & billing, a sandbox's own page and Networking no longer slow down as an account's history grows: on an account with 100,000 sandboxes in a month, Home opens in under a tenth of a second instead of 1.5 s, and Usage & billing in 0.15 s instead of 1.2 s. Older pages of the audit log, and the log filtered to one kind of change, open as fast as its first page. See the audit log.
Your account's limits, from the API
GET /v1/limits (and runtime.limits.get(), and the runtime_limits_get tool) now lists every limit the account is held to with what it uses of each now, the numbers a create past one is refused quota_exceeded by: sandboxes at once, their vCPUs and memory, volumes and the rest. An agent can watch them and hold back before it is refused. See Limits.
Agent-only wallet accounts top up, watch their credit and recover a lost key
On an account an agent opened with a wallet and no person pays for, an out-of-credit answer now tells the agent to add credit itself with npx withruntime billing topup <usd> (details.addCredit.by is agent). GET /v1/limits gains credit: the balance, the daily pace, the days it lasts and whether it is ok, low or empty. Webhooks can subscribe to credit.low and credit.empty. A lost key is replaced with the claim code (runtime billing claim <code> --new-key), which revokes every other key; at most 3 times a day, logged in the audit log, until a person takes the account over. See pay with stablecoins, limits and events.
Swarm worker keys stay inside their own sandboxes
A key made by another key with reach agent now gets 403 forbidden on the account's own settings, whatever its person's role: closing the account, webhooks, telemetry exports, the audit log, credit and billing, secrets, domains and networks. It still runs sandboxes, reads its own usage and makes its own keys; an account-wide one keeps everything. See Run a swarm.
Code interpreter cells and terminals show in a sandbox's commands
A sandbox driven only by E2B's runCode / run_code listed no commands at all. Each cell is now kept as its language (python-cell · exit 1 · 2 s for a cell that raised), and a terminal as its shell; never the code or what is typed. See observability.
mkdir -p /workspace through the files API is success
files:mkdir (and the files tool's mkdir) on /workspace or / answered 400 "Refusing the root of a tree"; it now answers created: false, as for any folder that already exists. And GET /v1/usage?key= with something that is not a key's id answers 400 invalid_request rather than 500.
Wallet accounts and the welcome match
An account an agent opened with a wallet, and that no person has taken over, no longer earns the welcome match or a referral reward on its payments. Once a person takes it over, its later payments earn them as usual. See paying with stablecoins.
A key makes more keys over the API, with no browser
For agent swarms and for accounts opened with a wallet. POST /v1/keys, GET /v1/keys and DELETE /v1/keys/{id}, runtime.keys.create/list/revoke/usage in the TypeScript SDK, and runtime keys create --name worker-1 --daily-limit 5 with a key on the machine (--browser keeps the browser approval). New: runtime keys ls, runtime keys usage <keyId>, runtime keys revoke <keyId>, and GET /v1/usage?key=. Each key is its own agent, a new key never has more than its maker, and the daily limits of the keys a key made add up to at most its own. See run a swarm.
The Python, Go, Java and Ruby SDKs no longer take a failure or a cut stream for a success
A call that runs longer than 90 seconds gets its status early and its answer after; when that answer is an error (a create whose host was lost, say), Go, Java and Ruby now raise it, as JavaScript and Python did, instead of returning an empty result. A file read in Go, Java or Ruby is checked against the length and SHA-256 the API sends with it, read again if it came short, and refused rather than returned short. In Python's synchronous client, an event stream (a watch, a log follow) whose connection closed part way raises instead of ending as if it had finished. Each arrives with that SDK's next release.
Free usage is for trying Runtime, and a lower limit applies to every account at once
An account that has never paid gets its 100 free hours (100 GiB-hours of memory and 25 vCPU-hours of active CPU) once, across the 30 days from its opening, and then nothing until it adds credit. An account that has paid gets them every month, as before. Saved copies (10 GB) and disks (5 GB) stay monthly for every account, and the startup hours are unchanged. GET /v1/usage shows freeUntil on each of allowances: when the free machine time ends, or null once the account has paid. Usage & billing and the sign-in and offer pages say it the same way.
Without credit, fewer sandboxes at once, and a few new limits
Four sandboxes run at once, not eight, with at most 8 vCPU and 16 GiB in all, not 16 and 32. An account keeps at most 10 sandboxes, running, paused or stopped (a create past it is refused with no_credit_kept_limit, 409), and makes at most 50 a day, in any 24 hours (no_credit_daily_limit, 429). Waking, resuming or deleting a sandbox you already keep is never refused. Scheduled jobs do not run without credit: a job waits with blockedReason credits until the account holds credit. Adding credit lifts all of these. Public previews and ports other than 80 and 443 were already for paid accounts only. The Python SDK's Inspect integration defaults to four sandboxes at a time.
Every limit is published, and an account with credit is charged, not capped
With credit, an account keeps up to 10,000 volumes, snapshots, images, volume backups, jobs and secrets (5 volumes before), with no limit on the GBs of volumes and images, which its credit pays for. A quota_exceeded now names the limit and its number in its message and in details (limit, max, raise), including the vCPU, memory and disk limits that said only "quota exceeded". The limits guide lists every one, and the console's Limits page shows each with what the account uses.
A stop or delete never loses a snapshot or a sandbox's disk
Stopping or deleting a sandbox while a snapshot of it is still being taken is now refused with snapshot_in_progress (409) and nothing changes, instead of destroying the sandbox and failing the snapshot; wait until the snapshot is ready and stop it again (see troubleshooting). A stop that comes while a paused sandbox is waking from its saved copy, or is still being copied to another host, or just after that copy was restored, keeps the copy and the disk. A resize of a sandbox that only its saved copy holds wakes it from that copy. A volume lost with its host keeps its newest ready backup past its retention, so the backup the error tells you to restore from is still there.
An agent with no shell can open and pay for an account over MCP
Two new tools, runtime_wallet_open and runtime_wallet_claim (also at /mcp?signup=wallet), open an account paid in USDC: the first answers with an address per network, the exact amount and a claim code; the second connects once the payment lands. There is no free trial on this path. The Go, Ruby and Java SDKs gain the wallet calls, and runtime_connect picks up a key saved after the MCP server started. See pay with stablecoins.
No paid-or-trial choice in the SDKs
Free usage comes first, then credit, and there is nothing to choose, so the examples and options that showed funding are gone and Harbor and Inspect tell an account without credit to add credit for a bigger size. The option is still accepted (deprecated in Go and Java), so existing code runs.
A preview, port or private stream keeps going when you extend the time limit
A long download through a private preview was cut at the end of the limit it began under even though you had extended the sandbox, and it now carries on into the new limit. A limit that really ends still cuts it.
Pages in the console answer faster
Every page waits less for the sign-in check and makes fewer database round trips, a click from page to page no longer waits a fixed 0.3 seconds, and a new account's Home is built once, not twice.
A slow command start no longer holds up the sandbox's other calls
Starting a command no longer blocks listing processes, reading or writing files and killing processes while it waits for a slot. A command that waits in line longer than 6 seconds is refused as busy, which is safe to retry, instead of ending with an unknown outcome.
A short database outage no longer fails a start, stop, wake or delete
A broken database connection no longer ends one of these as operation_failed, and after a database restart the first request on a reconnected connection is answered instead of failing with the old session's error.
A member an owner removed stays removed
If an owner removes someone, or they leave, after your directory had deactivated and an invitation had brought them back, single sign-on directory sync no longer restores their membership when it turns them on again.
A wallet top-up that never reached the payment provider says so
A claim whose top-up was never created no longer shows a pay-by time; it says to send the top-up again with the claim code.