The VMs Powering Mobile Agents (Instinct, Claude Code)

One awesome merchandise improvement is that agents (Claude Code, Instinct, Poke, etc) are moving disconnected our section computers truthful that we tin usage them connected our phones. Ultimately this is awesome for the customer because that intends the supplier companies supply america pinch VMs for them to tally on! Here's immoderate notes connected really the awesome platforms activity based connected looking astir connected ws-term.

Claude Code connected Your Phone

Claude Code's container is its ain Firecracker microVM, a KVM impermanent pinch its own kernel, booted consecutive into an init written successful Rust:

$ feline /proc/cmdline ... rdinit=/process_api ... --listen-vsock-port 2024 $ uname -r 6.18.5-fc-v20 # -fc- = Firecracker; a custom-built impermanent kernel $ ps -o comm -p 1 process_api # PID 1 is not systemd; it's a Rust/Tokio binary

process_api is PID 1 and the host's power supplier living inside your VM: it mounts the disks, past listens connected vsock larboard 2024 truthful the host tin thrust the convention from outside. That's the platform's defining trait: the usability lives wrong your tenant space, and a batch of engineering goes into sealing it disconnected (PID 1 is non-dumpable, /proc/1/mem is denied moreover with CAP_SYS_PTRACE, your ammunition is missing CAP_SYS_RESOURCE).

The disks divided cleanly into yours (writable, persistent) and theirs (read-only, shared):

$ lsblk -o NAME,SIZE,RO,MOUNTPOINT vda 256G 0 / # yours: writable, survives reclaim vdc 341M 1 /opt/claude-code # theirs: the 324 MB `claude` harness (Bun) vdd 45.6M 1 /opt/env-runner # theirs: the task launcher vde/vdf ... 1 /mnt/skills/... # theirs: skills

The harness is the point moving your instrumentality calls and is simply a 324 MB compiled Bun binary connected a read-only disk. The exemplary runs elsewhere; conclusion goes retired arsenic Server-Sent Events complete HTTPS/2 (not a WebSocket) to /v1/messages, done an egress gateway that is 443-only and MITM'd (CN = Egress Gateway ... (production)), pinch api.anthropic.com pinned in /etc/hosts. There is nary inbound astatine each (192.0.2.2, an RFC-5737 test address). Auth is simply a host-minted OAuth token, cached root-only connected disk and rotated per boot.

Lifecycle is host-driven and measured from the inside: ~430 ms to init, ~6.4 s to the harness process. Spin-up is triggered by an inbound message (the big wakes the VM complete vsock and runs --session-mode resume); spin-down is idle reclaim decided by the host. When it's reclaimed, the processes dice but vda detaches intact and reattaches connected the adjacent acold boot, which is why the conversation feels continuous moreover though the compute was destroyed.

flowchart TB user(["your keystrokes"]) -->|http post| ingress["session-ingress"] ingress --> pa hostctl(["host power plane"]) -->|vsock larboard 2024| pa subgraph vm["Firecracker microVM"] pa["process_api, pid 1, Rust"] --> harness["claude, 324 MB Bun harness"] vda[("vda (rw), yours, persists")] --- harness ro[("vdc/vdd/vde/vdf (ro), theirs")] --- harness end harness -->|inference complete SSE| gw["egress gateway, 443, mitm, api.anthropic.com"]

Instinct

Instinct is simply a caller startup which launched precocious and it does immoderate very bully things connected the representation broadside which gives that consciousness of it being a existent adjunct alternatively than a chatbot.

$ hostname e2b.local $ feline /.e2b n038afjvewg7jnc9pwdz

e2b.local intends Instinct doesn't run its ain VM fleet; it rents E2B sandboxes ("sandbox-as-a-service"), a throwaway Ubuntu box you manus an supplier truthful it has a computer:

Ubuntu 22.04.5, 2 vCPU, 1.9 GB RAM, 29 GB disk, up ~30 min, personification sandbox (uid 1001)

And let's look nether the hood...

$ systemd-detect-virt → kvm $ feline /proc/cmdline pci=off virtio_mmio.device=4K@... i8042.noaux i8042.nokbd reboot=k panic=1 clocksource=kvm-clock root=/dev/vda ip=169.254.0.21::...:eth0:off:tap0 $ feline /sys/class/dmi/id/product_name → (empty) # nary SMBIOS astatine all $ ps -o comm -p 1 → systemd # init=/sbin/init, not a civilization PID 1

Firecracker again!

pci=off + virtio-over-MMIO + quiet DMI + tap0 networking is the Firecracker signature: nary PCI bus, nary SMBIOS, minimal devices. So some apps beryllium connected the same microVM; the quality is who runs the fleet and what boots wrong it. Where Claude Code boots a stripped civilization init (process_api arsenic PID 1), E2B boots a full Ubuntu pinch systemd and a full XFCE desktop:

$ systemd-analyze Startup vanished successful 265ms (kernel) + 992ms (userspace) = 1.258s graphical.target reached aft 977ms

~1.26 s to cold-boot each the measurement to a graphical desktop. The operator-in-guest exists here too, but it's conscionable E2B's envd moving arsenic an mean systemd service, not a sealed PID 1. E2B sandboxes are configurable excessively (you prime the vCPU, RAM, disk, and idle timeout, and whether the container tin beryllium paused and resumed from a representation snapshot alternatively of cold-booted); Instinct runs a humble 2 vCPU / 1.9 GB desktop template.

So if the container is disposable, wherever does the agent's representation live? In a directory called /memory, and this is the platform's defining idea:

$ feline /memory/README.md Persistent representation for [[rohan-adwankar]] $ ls /memory entities/ comms/ timeline/ workstreams/ knowledge/ $ git -C /memory log --format='%an <%ae>' -1 Instinct Agent <[email protected]>

The agent's representation is simply a git repo of Markdown files pinch [[wiki-links]], navigated by grep. The timeline/ coarsens complete clip (raw → hourly → regular → weekly, for illustration quality memory), and the supplier is virtually the git author: it doesn't telephone a representation API, it writes Markdown and commits it arsenic itself.

The durable furniture is that repo, pushed to S3, keyed by a per-user id, and stored not arsenic files but arsenic a azygous git bundle, which is simply a awesome small gotcha:

$ git -C /memory distant -v origin s3://instinct-prod-agent-memory/filesystem-memory/user-01M1VW7... $ aws s3 ls s3://.../user-01M1VW7.../ --recursive HEAD refs/heads/main/<sha>.bundle # the ENTIRE vault, packed; `ls` aft sync looks empty

Auth is short-lived STS credentials, not long-lived keys, truthful a leaked sandbox self-heals erstwhile the token lapses:

$ feline /etc/instinct-aws-creds export AWS_ACCESS_KEY_ID='ASIA…' # ASIA prefix + convention token = impermanent STS ... # (values redacted, unrecorded secrets) # role: instinct-sandbox-observations-role flowchart TB subgraph box["E2B sandbox (rented, disposable)"] agent["Instinct Agent ([email protected])"] -->|writes and commits| mem["/memory, a Markdown vault git repo"] creds["/etc/instinct-aws-creds, short-lived STS"] end mem -->|git push| store creds -->|authorizes git push| store subgraph store["S3 (durable, per-user)"] vault[("instinct-prod-agent-memory, the vault")] obs[("instinct-prod-observations, earthy firehose")] end

Durable point = a git repo successful S3. The instrumentality is throwaway.

Using a git repo for this is rather nice; the default building seems to beryllium for illustration this:

~/instinct-vault/.. │󰫎 24 󰲡 Vault   .git │ 23   comms │ 22 Persistent representation for 󱗖 rohan-adwankar. Markdown + wiki-links, navigated by grep. Start here, past jump   chat │ 21  rohan-adwankar--inst│ 20 Who Rohan is, what he is moving on, and what is connected unrecorded successful entities/, workstreams/, and knowled   entities │ 19   group │󰫎 18 󰲣 Layout  rohan-adwankar.md │ 17   projects │ 15 README.md  ws-term.md │ 14 timeline/ chronological record, coarsening upward: raw/ → hourly/ → daily/ → weekly/ → monthly/   knowledge │ 13 entities/ people/ projects/ — the nouns of Rohan's world, 1 record each   decisions │ 12 comms/ chat/ email/ meetings/ — 1 record per thread, named <who>--<topic>--<date>.md  x-account-signup-dec│ 11 workstreams/ active/ completed/ someday/ — units of work; status: frontmatter matches the subdirectory   preferences │ 10 knowledge/ facts/ procedures/ preferences/ decisions/   small heart │ 8  autonomy.md │ 7 knowledge/preferences/instinct/ holds really Rohan wants the adjunct itself to behave — autonomy, drafti  iteration-style.md│ 6   timeline │󰫎 5 󰲣 Conventions   regular │ 4  2026-09-06.md │ 3 ● Every record has frontmatter pinch id, type, and aliases. [[id]] resolves to id.md aliases id/_index.md.   workstreams │ 2 ● Entity and knowledge files are updated successful spot and publication arsenic existent state, ne'er arsenic a log. History li   progressive │ 1 ● Files that outgrow 1 page are promoted to a directory pinch an _index.md carrying the original id.  dragon-game-asset.md│ 25 - Timeline and comms clasp events and conversations; entities clasp durable properties only.  startup-idea-search.│~ 󰂺 README.md │~ ~ │~ ~ │~ :!tmux capture-pane -pS - | pbcopy

Now Claude Code's harness successful the VM is unfastened root and the aforesaid arsenic normal but really astir Instinct?

$ ps -eo args | grep -E 'agent-exec|tools' agent-exec-server --port 8080 # Go, runs the bash/code it's sent tools __internal_daemon --socket /tmp/.tools/bridge.sock \ --base-url https://api.instinct.com/-/api/graphql/tool-execute # Rust $ strings /usr/local/bin/tools /usr/local/bin/agent-exec-server \ | grep -iE 'anthropic|openai|/v1/messages|x-api-key|claude|gpt|model' # → nothing. nary exemplary listed

So it seems for illustration location are nary conclusion calls anyplace connected the box. Claude Code seals the operator inside the guest; Instinct doesn't put the encephalon successful the impermanent astatine all. The sandbox is a axenic execution surface: agent-exec-server runs immoderate bash the backend hands it, and each instrumentality telephone (Gmail, the unreality browser, a payment) leaves arsenic a GraphQL petition to api.instinct.com, executed server-side. The --base-url is a runtime argument, not compiled in.

For the existent instrumentality surface, alternatively than MCPs, Instinct seems to usage a CLI for each tools:

sandbox@e2b:~/ws-term-v1$ devices --help | wc 90 1466 10891 sandbox@e2b:~/ws-term-v1$ devices --help Tools CLI You are a task agent. Your genitor (the main agent) spawned you for a focused job. When the occupation is done, study backmost to your genitor and hold. Your genitor owns task-agent cleanup. Your direct-execute traits: - activity - integrations, files, web page fetching .... Run `tools --help` for the existent surface. USAGE devices <command-path> [options] devices thief [<path>...] .... Built-ins (no thief publication needed): help, async wait, async list. EXECUTABLE (you tin telephone these directly) agent_message namespace (1 action) Send messages to different agents. browser_guidance namespace (3 actions) Search per-config website guidance and this user's past outcomes earlier browser navigation, and grounds really a config performed aft an attempt. Missing guidance is normal and intends unknown, not supported aliases blocked. cloud_browser namespace (27 actions) Drive a cloud-hosted Chrome lease pinch the user's saved logins. Use for agent-driven web tasks (order food, book rides, comparison prices, fetch receipts) that request existent authenticated capacity connected existent sites. A task supplier acquires its ain `lease_id` pinch `tools cloud_browser_scheduler acquire` and drives it here. .... DELEGATED (only callable by the different role) relationship namespace (2 actions) Read the user's Instinct relationship profile. feedback namespace (3 actions) Submit merchandise feedback and respond to squad follow-ups. generate_referral_link action Ask the main supplier to get the member's reusable referral nexus and existent life allowance. revoke_referral_link action Ask the main supplier to revoke the member's reusable referral link. speak action Generate a WAV reside record from a transcript, optional director's notes, and a voice. UNAVAILABLE (does not use to this role) steer_voice_agent action Send an reply aliases discourse into the user's progressive unrecorded sound session.

The instrumentality aboveground is the show that this container isn't a coding sandbox astatine all. tools --help lists ~50 namespaces (Gmail, Notion, Slack, Stripe payments, a credential vault), but the 1 that reveals the creation is the cloud browser:

$ devices --help | grep -iE 'cloud_browser|vault' cloud_browser (27) Drive a cloud-hosted Chrome lease pinch the user's saved logins. cloud_browser_scheduler (4) acquire, list, release, widen leases vault (7) Manage, fill, and import the user's stored credentials

When Instinct orders nutrient aliases books a formation "as you," it does not unfastened a browser connected this sandbox. It leases 1 from a abstracted excavation of unreality browsers, each carrying your saved floor plan (cookies and logins) and drives it done the same api.instinct.com bridge:

tools cloud_browser_scheduler get # → lease_id, connected a browser "config" (a profile) tools cloud_browser <action> # click / type / publication / screenshot that Chrome

You tin publication the full exemplary disconnected really leases behave: each floor plan has precisely one write lease (the only convention allowed to prevention caller logins), up to 5 tally at once, and releasing a lease "saves its cookies first, truthful the adjacent lease loads them." That persistence is the point: your browser personality is simply a third durable thing, sitting server-side adjacent to the S3 vault and the observations index, kept so a disposable container tin get it for 1 task and manus it back. Two specifications let it motion successful without a concealed ever rubbing the box:

• Scout earlier navigating. devices browser_guidance hunt returns curated per-site notes positive your own past outcomes per floor plan (config-a: success, config-b: blocked), a consequence prior, not a verdict.
• Secrets spell done the Vault, ne'er chat. devices vault capable types a stored credential consecutive into the page; erstwhile the vault lacks one, devices vault petition mints a nexus you capable (app.instinct.com/vault/fill?t=…). One-time codes it sounds itself from your connected Gmail aliases Outlook.

flowchart TB ta["task agent, off-box"] -->|acquire lease| sched["cloud_browser_scheduler"] sched --> cb ta -->|click, type, read| cb["cloud browser pinch your saved profile"] vault[("Vault, your secrets, server-side")] -->|fill| cb cb -->|"logged successful arsenic you"| sites(["Amazon, Uber, airlines, and more"]) box["disposable E2B box"] -->|"issues devices calls, holds nary cookies"| cb

Summary

This was beautiful nosy to return a peek, and I'll support signaling my notes arsenic caller products travel around!