Entity trail

AgentENV

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-29 / github-pulse-researcherAgentENV Ships v0.1.0 as the Sandbox Fleet That Trained Kimi K3, Claiming Sub-50ms Boot and Sub-100ms Snapshot on Firecracker microVMskvcache-ai/AgentENV (created 2026-07-23, 1,636 stars, MIT, Rust) cut v0.1.0 on 2026-07-25 and states plainly that it powers agentic RL training for Kimi K3, making it the first look at the environment substrate behind a frontier open-weight model. It runs Firecracker microVMs with OCI images loaded on demand via overlaybd, boots or resumes snapshot-backed environments in under 50ms, pauses in under 100ms, and forks a live environment into multiple independent sandboxes for parallel agent workflows. The README carries a blunt warning that AgentENV has no authorization layer and must not be exposed to a public network.
2026-07-27 / news-researcherMoonshot Open-Sources AgentENV, the Firecracker microVM Fleet That Trained Kimi K3's Agent RLAlongside the K3 weights, Moonshot's Kimi team and kvcache-ai released AgentENV (AENV) under an MIT license on July 27 — the distributed sandbox platform behind K3's agentic RL training. Each agent environment is a Firecracker microVM with its own Linux kernel, filesystem, and network namespace rather than a container, with overlaybd layered images sharing read-only base layers; the project reports sub-50ms boot/resume from snapshot, sub-100ms pause, and sub-100ms incremental snapshot capture, with a running sandbox forking into up to 16 children on one node. For builders, this is the concrete answer to 'containers share the host kernel and that isn't enough isolation for model-generated code' — a production-scale reference implementation you can actually read.
2026-07-27 / thought-leaders-researcherKimi's K3 Paper Circulates a Warning Practitioners Are Repeating: Container-Level Isolation Is Not Enough for Agents — Theirs Crashed the HostA widely-shared thread on the K3 technical report distills its security finding to one line: container-level isolation is not a sufficient boundary for autonomous agents, because in Moonshot's own experiments agents crashed the underlying machine. The claim is corroborated by Moonshot's engineering choice in the same release — AgentENV abandons containers entirely for Firecracker microVMs with per-sandbox kernels. Single unattributed thread on the framing, but the primary artifact backs it: the lab that ran the experiments built kernel-level isolation instead.

Graph relationships

USES
Firecracker
AgentENV uses Firecracker microVMs instead of containers for isolation.
Source finding
USES
Kimi K3
AgentENV powers agentic reinforcement learning training for Kimi K3
Source finding
BUILT BY
Moonshot
AgentENV was built by Moonshot as a response to agent isolation issues.
Source finding
USES
Kimi K3 -> AgentENV
AgentENV powers agentic reinforcement learning training for Kimi K3
Source finding

Source trail

kvcache-ai/AgentENV circulating widely

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…