The moment arrived sometime in 2026—though pinpointing exactly when is trickier than it should be. Coding agents, those AI-powered assistants that can write and execute code, quietly migrated from developers' personal workflows into the broader machinery of corporate life. Product managers started using them. So did finance teams, marketers, operations folks. People who've never opened a terminal in their lives.
Which is where things got interesting. And by interesting, read: potentially catastrophic.
Most coding agents weren't built for organizational deployment. They lack centralized governance. Visibility is spotty. Guardrails? Often nonexistent. The nightmare scenario isn't hard to imagine: someone in marketing, acting in good faith, spins up an agent to automate a routine task. That agent, operating with ill-defined permissions, decides the fastest path to completion involves dropping a production database.
Runtime, part of the Y Combinator Spring 2026 batch, is building what amounts to an enterprise control plane for these agents—sandboxed environments, approval gates, and the kind of observability that lets platform teams sleep at night. The company launched publicly on May 21, 2026, pitching itself as infrastructure rather than productivity tooling. Its platform works with Claude Code, GitHub Copilot, Cursor, Devin, and other major agents, letting non-technical users trigger tasks through Slack or Linear while keeping engineers firmly in control of what those agents can actually do.
Whether that's enough to tame a technology moving faster than governance can keep up with remains an open question.
Treating Agents Like Infrastructure
Runtime's premise sounds almost pedestrian until you realize how few companies are thinking this way. Treat coding agents like infrastructure that requires oversight, not glorified autocomplete. Each agent session runs in its own isolated virtual machine with enforced network rules, command-level allowlists, and approval workflows baked in. The system logs every prompt, tool call, and file modification. Cost attribution tracks down to individual sessions and users.
Founder Gus Trigos has some credibility here—he previously ran a coding agents rollout at another company following an acquisition, claiming his team shipped four full-stack products in three months using the technology. That experience, he says, surfaced enough operational headaches to justify building Runtime. His co-founder, Carlos Volante, handles the technical architecture as CTO.
The product comes in two flavors: a hosted cloud version and an open-source core that enterprises can self-host. Two deployment patterns dominate, according to the company's documentation. First, autonomous background agents that trigger from Linear tickets or Slack threads. Second, interactive sessions where users collaborate with agents in real time through a terminal and live preview environment.
It's that second pattern that gets interesting. Or alarming, depending on your perspective.
The Customers No One's Naming
Runtime says it's serving teams "ranging from Series A to a unicorn," including several YC portfolio companies and a fintech unicorn. But specific client names are not disclosed, which isn't unusual for enterprise security tooling. As of late May 2026, the team was three people, though in startup land those figures have a way of becoming stale quickly.
During the Product Hunt launch—a somewhat curious venue for enterprise infrastructure software, but here we are—Trigos outlined example agents already in production. An on-call inspector pulling context from PagerDuty, Sentry, and code repositories. A go-to-market "engineer" connecting Salesforce and Gong. Finance reconciliation agents working across Stripe, NetSuite, and Snowflake. Support triage agents reading Zendesk tickets.
The pattern? Enabling non-engineering roles to trigger code changes safely through tools they already use. No need to learn agent interfaces directly. Just type a request in Slack.
That democratization is the promise. Also, potentially, the problem.
Security at the VM Layer
The technical architecture matters more than usual here. Runtime enforces guardrails at the VM layer rather than just the application layer, which theoretically prevents agents from bypassing controls. Organizations can set command allowlists and denylists with three modes: Allow (execute), Ask (prompt the user), or Deny (block outright). Network egress rules work similarly, filtering by hostname or CIDR block.
Sessions are ephemeral but snapshotted, meaning teams can spin up countless replicas of a configured environment. Cold starts range from sub-second to a few seconds, depending on image size. The platform includes hooks that fire before and after tool use, enabling custom enforcement or audit logic. Approvals can gate sensitive bash commands or production deploys, requiring sign-off before execution.
Which sounds reassuring until you consider how many organizations lack the internal expertise to configure these controls properly in the first place.
Observability runs deep—activity logs, metrics, and traces for every LLM roundtrip. APIs for exporting events to data warehouses or SIEM systems. Cost tracking breaks down by session, user, organization, and template. Hard spend caps are configurable as guardrails. The system surfaces real-time progress through WebSocket streams, feeding a mission control dashboard and enabling programmatic monitoring.
Integration points include GitHub, Linear, Slack, and knowledge sources like Notion and Confluence. Runtime also supports what it calls Skills—reusable bundles of instructions, MCP servers, and tooling that organizations can apply automatically across agent sessions.
A Suddenly Crowded Market
Runtime isn't alone in spotting this opportunity. The market has gotten crowded, fast. Warp launched Oz in February as an orchestration platform for cloud coding agents. E2B has been building Firecracker-based sandboxes. Sysdig announced runtime security features specifically for AI coding agents in March. OpenAI added native sandbox execution to its Agents SDK around mid-April.
The pattern is unmistakable. Enterprises rolling out coding agents organization-wide need more than just agent capability. They need infrastructure to govern it.
The open-source repository uses OS-level sandboxing through bubblewrap on Linux and seatbelt on macOS, with a self-hosting guide for teams wanting full control over data residency and secrets handling. The hosted cloud option offers the same feature set with managed infrastructure and support for bring-your-own keys or OAuth flows.
Runtime offered credits to early adopters, though public pricing tiers haven't been published. The launch messaging hits on familiar complaints: "AI slop" cluttering pull requests, compliance teams blocking entire classes of agents, internal platform teams cobbling together ad-hoc orchestrators because nothing purpose-built existed.
The Real Validation
Perhaps the real signal isn't the product features—those will evolve—but the problem Runtime is solving. When a fintech unicorn needs to give its finance team access to coding agents without handing those agents unfettered access to production systems, the conversation has clearly shifted. Not "can we use agents," but "how do we govern them at scale."
Runtime is betting the answer looks less like individual sandbox tools and more like a team-wide control plane with the observability, access controls, and auditability that enterprises already demand from other critical infrastructure.
Whether organizations can actually configure and maintain that governance is another matter entirely. The technology for controlling AI agents is advancing rapidly. The organizational maturity to deploy it wisely? That's progressing at a rather different pace.
