The Quick Answer: Configuring Cloudflare Sandboxes in Cursor

To isolate Cursor Cloud Agents inside ephemeral Cloudflare Sandboxes rather than running arbitrary shell commands on your local host, add this configuration block to .cursor/environment.json:

{
  "agentExecution": "cloudflare-sandbox",
  "sandbox": {
    "accountId": "your_cloudflare_account_id",
    "apiToken": "${env:CLOUDFLARE_SANDBOX_TOKEN}",
    "timeoutMinutes": 30,
    "allowedOutboundHosts": [
      "github.com",
      "registry.npmjs.org",
      "pypi.org"
    ]
  }
}

Once configured, any terminal execution initiated by Cursor Composer or background subagents runs inside a dedicated, throwaway Linux microVM. Host files, SSH keys, and local environment variables stay completely untouched.

---

The Security Dilemma of Autonomous AI Coding

Autonomous coding agents need terminal access. They run test suites, install dependencies, and execute git commands to verify their own code.

However, giving an LLM unfiltered root access to your development machine is hazardous. A single hallucinated rm -rf command, a malformed curl | bash script, or an injected prompt inside a third-party dependency can wipe your drive or exfiltrate private API keys.

In early September 2026, Cloudflare and Cursor released native support for Cloudflare Sandboxes. This shifts agent execution from your developer workstation to serverless, hardware-isolated microVMs booted in under 200 milliseconds.

---

Execution Environment Comparison Matrix

The table below contrasts traditional local execution against containerized Docker workflows and Cloudflare Sandboxes.

Dimension	Local Workstation	Local Docker Container	Cloudflare Sandbox MicroVM
Boot Latency	Instant (0 ms)	1.8 – 3.5 seconds	~180 milliseconds
Host Isolation	None (full filesystem access)	Namespace shared kernel	Hardware-enforced KVM microVM
Credential Safety	Exposed (~/.ssh, ~/.aws)	Requires manual volume masks	Zero local host access
Resource Contention	Competes with IDE & browser	CPU and RAM pinned locally	Zero load on local machine
Network Egress Control	Open	Docker bridge network rules	Per-domain egress whitelist
Persistence	Permanent	Ephemeral if --rm passed	Strictly disposable per agent run

For corporate repositories and teams handling sensitive client data, isolated microVM execution eliminates the single largest barrier to adopting fully autonomous agent loops.

---

Step 1: Obtain Cloudflare Sandbox API Credentials

You need a Cloudflare account with the Workers & Sandboxes entitlement enabled.

1. Navigate to the Cloudflare Dashboard and select Compute (Workers) > Sandboxes.
2. Click Create API Token.
3. Grant the token Workers Sandboxes:Edit and Workers Sandboxes:Read permissions.
4. Export the token in your shell profile (~/.bashrc or ~/.zshrc):

export CLOUDFLARE_SANDBOX_TOKEN="cf_snd_984a1b028f89c02e11"

Verify that your token works via curl:

curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/YOUR_ACCOUNT_ID/workers/sandboxes" \
  -H "Authorization: Bearer $CLOUDFLARE_SANDBOX_TOKEN"

If the response returns "success": true, your account is ready to provision compute sandboxes.

---

Step 2: Initialize Cursor Sandbox Profile

Create a directory named .cursor in your project root if it does not already exist:

mkdir -p .cursor

Create .cursor/sandbox-policy.json to define which operating system image and pre-installed toolchains your agent requires:

{
  "baseImage": "ubuntu:24.04",
  "preInstalledRuntimes": [
    "nodejs-22",
    "python-3.12",
    "git"
  ],
  "resourceLimits": {
    "vCpu": 2,
    "memoryMb": 4096,
    "diskGb": 10
  },
  "snapshotWarmPool": true
}

Setting snapshotWarmPool: true keeps warm snapshot templates ready at the Cloudflare edge. This drops subsequent tool-call cold-start overhead to near zero.

---

Step 3: Triggering Cloud Agents with Isolated Tool Calls

Open Cursor and summon the Agent Composer (Ctrl+I or Cmd+I).

Switch the agent mode toggle to Cloud Agent. You will see a small badge displaying: Environment: Cloudflare Sandbox (Edge-Isolated).

Enter your task prompt:

Refactor src/services/auth.ts to use the new session validator.
Run the test suite with npm test, inspect any failing assertions,
and resolve type mismatches autonomously.

When Cursor runs npm test and npm install, the commands execute entirely within the remote microVM. You can view the live stdout stream directly inside the Cursor terminal drawer without a single process spawning on your Linux machine.

---

Inspecting MicroVM Run Logs and Network Calls

Every sandbox run generates an auditable security trail.

To inspect what outgoing network connections your agent attempted during execution, check the sandbox activity log via the Cloudflare CLI:

# List recent sandbox executions
npx wrangler sandbox list

# Inspect network telemetry for a specific session ID
npx wrangler sandbox logs --id snd_20260907_bf108

Example audit output:

{
  "sessionId": "snd_20260907_bf108",
  "status": "terminated_clean",
  "durationSeconds": 42.6,
  "commandsExecuted": [
    "git status",
    "npm test",
    "npx vitest run --reporter=json"
  ],
  "blockedNetworkAttempts": [
    "192.168.1.1:80 (Blocked by RFC1918 egress policy)"
  ]
}

Any attempt by a compromised package or agent loop to probe your private internal network is blocked by default at the virtual network adapter level.