Agent session isolation compared: AWS microVM, Azure Foundry, Google sandbox and Anthropic Managed Agents

Summary. In the first half of 2026, AWS, Microsoft, Google and Anthropic each rebuilt their agent runtimes around the same idea: the session, not the request, is the unit of compute. They agree on that. They disagree on what runs the session. AWS Bedrock AgentCore gives every session a dedicated Firecracker microVM and terminates it after a 15-minute idle timeout or an 8-hour maximum lifetime, at $0.0895 per vCPU-hour and $0.00945 per GB-hour as listed on 18 June 2026. Microsoft's Foundry-hosted agents, rebuilt in April around per-session isolation, use a per-session VM-isolated sandbox with the same 15-minute idle timeout but a 30-day maximum lifetime. Google Agent Engine keeps request scaling inside the reasoning loop, with container_concurrency defaulting to 9, and pushes untrusted code into a separate sandbox. Anthropic Managed Agents split the thing into session, harness and sandbox, and the Cloudflare integration announced on 19 May 2026 lets that sandbox be a full microVM or a lighter V8 isolate. Analyst Janakiram MSV mapped the convergence in The New Stack on 26 June 2026.

Pick wrong and you either pay for isolation you do not need or ship a tenancy bug.

Why the session became the unit

A stateless HTTP request can go to any replica. That assumption is what load balancers are built on, and it is what agent workloads break. An agent run holds conversation state, writes files, executes code it was handed by a model, and lives for minutes or hours rather than milliseconds. Route the second turn of that conversation to a different replica and you have not just lost a cache, you have lost correctness.

Janakiram MSV, a practicing architect, research analyst and advisor to Silicon Valley startups, framed the shift in The New Stack: "The agent session is becoming the operational unit of enterprise AI infrastructure." His sharper observation is about the plumbing: "The load balancer starts to behave less like a traffic distributor and more like a session router."

The distinction that matters for anyone who has run sticky sessions before, in his words: "Traditional sticky sessions are usually performance optimizations, whereas in an agent runtime, session binding becomes a correctness and security requirement."

That is the reframe. Sticky sessions used to be a performance nicety you could lose without consequence. In an agent runtime, the binding is load-bearing.

The four runtimes side by side

The routing and lifecycle model converges. The execution substrate diverges. That is the entire story, and it is why a table like this is more useful than any vendor's own marketing page.

AWS: isolation and routing fused

AgentCore is the most opinionated of the four. Each session gets its own Firecracker microVM with isolated compute, memory and filesystem. Requests carrying the same runtimeSessionId are routed back to that microVM through a session header. When the session ends, the microVM is terminated and its memory sanitized.

Firecracker is not new, which is the point. AWS open-sourced it at re:Invent in 2018, demonstrated more than a hundred microVMs on a single laptop, and the same technology now runs Lambda and Fargate across trillions of executions a month. AgentCore is not inventing an isolation boundary for agents. It is pointing a proven one at them.

A session moves through Active while it processes work, Idle when provisioned but waiting, and Terminated after the 15-minute idle timeout or the 8-hour ceiling, per AWS's runtime documentation.

One detail deserves a code review of your own backend: AgentCore does not enforce session-to-user mappings. Your application has to maintain the relationship between users and their session IDs and set per-user session limits. The platform gives you an isolated box per session. It does not decide whose box it is.

That gap is not theoretical. When Asana disclosed a flaw in its MCP server in June 2025, the server had been live since May 1, a window of about five weeks. A tenant-isolation check failed and roughly 1,000 organisations could see project data belonging to other customers. MSV's summary of that class of bug is the sentence to pin above the desk: "Isolation was maintained while the user-to-session binding broke."

The boxes were sealed. The labels were wrong.

Azure: identity-led, and built for long runs

Microsoft rebuilt Foundry-hosted agents in April, per The New Stack's June 2026 survey, around per-session isolation. The platform creates a VM-isolated sandbox on demand, runs it, and tears it down at session end. There is no replica count to set and no warm pool to size.

The differentiator is identity. Each agent gets a dedicated Microsoft Entra identity, which makes the agent a first-class principal in the same directory that governs the rest of your estate. For enterprises that already run their access model on Entra, this collapses a governance problem that otherwise needs a bespoke answer.

The other differentiator is time. A 30-day maximum session lifetime against AWS's 8 hours is not a minor spec difference. It decides which workloads are even expressible. A research agent that works a case over a fortnight fits Azure's model and does not fit AgentCore's without you rebuilding session continuity yourself.

Google: split the loop from the code

Google Agent Engine is the hybrid, and it is the most instructive of the four precisely because it does not commit.

Its runtime keeps request scaling within the reasoning loop, a managed environment with configurable minimum and maximum instance counts and a container_concurrency that defaults to 9. Untrusted code execution is separated into an isolated Code Execution sandbox, and conversation state is externalised to Sessions and Memory Bank rather than held in the box.

Read that architecture carefully and it makes the industry's argument for it. Even the provider that kept the load balancer in the reasoning loop would not point that load balancer at stateful untrusted work. The reasoning loop is ordinary traffic. The code execution is not. Google drew the line in a different place, not a different shape.

Externalising state to Sessions and Memory Bank is also the pattern the other three converge on eventually, because a sandbox you can rebuild is only useful if the state does not die with it.

Anthropic: make the substrate swappable

Anthropic provides the clearest decomposition. Managed Agents virtualise the agent into three components: a session that logs everything that happens, a harness that runs the loop and routes tool calls, and a sandbox where code runs. The harness becomes a near-stateless control plane. The sandbox becomes a callable, rebuildable resource.

The Cloudflare integration, announced on 19 May 2026, shows what that decoupling buys. The agent loop runs on Anthropic while each tool call runs in a Cloudflare sandbox. Cloudflare's own framing is that the "brain" stays with Anthropic while the "hands" can run anywhere. That sandbox can be a full microVM through Cloudflare Containers, for agents that build applications and run Linux tooling, or a lighter V8 isolate for scale. Cloudflare's pitch for the isolate path is bursts of tens of thousands of concurrent agents, which it argues no VM-based approach reaches.

This is the portability answer. The other three fuse the substrate to the platform. Anthropic treats it as a layer you swap.

What this changes about your bill

Per-session billing rewires cost modelling. When billing is tied to active sessions, concurrency, idle time and agent sizing become the cost drivers rather than request volume. A team that has spent five years optimising requests per second is now optimising something else entirely.

AWS publishes AgentCore consumption at $0.0895 per vCPU-hour and $0.00945 per GB-hour, as listed on its pricing page on 18 June 2026, alongside separately billed components for memory, gateway tooling and identity. Those rates are not the interesting part. The 15-minute idle timeout is. An agent that finishes its work and does not close its session bills for up to fifteen more minutes of vCPU and memory, and multiplied across a support queue that is the difference between a sensible bill and a bad one.

The engineering judgement: close sessions explicitly. Do not wait for the idle timeout to do it for you.

Choosing, honestly

There is no correct answer here, and any vendor telling you otherwise is selling. The workload decides.

• A multi-day research or case-handling agent fits Azure's 30-day session. AgentCore's 8-hour ceiling means rebuilding continuity yourself.

• A code-heavy agent that runs Linux tooling on model-generated input needs microVM-grade isolation. AgentCore, or Anthropic pointed at Cloudflare Containers.

• High-volume, low-risk automation favours a lighter isolate. Paying for a microVM per session to run a classifier is paying for a boundary the workload does not need.

• An estate already governed by Entra gets identity for free on Azure and has to build it anywhere else.

• If you expect to move, Anthropic's decoupling is the only architecture that treats the substrate as swappable.

Most enterprise platforms will end up running more than one of these patterns. That is a reasonable outcome, not a failure of strategy.

The unresolved argument, in MSV's framing, is between microVMs and lighter isolates, and it will decide the trade-off between isolation and density. Density is cheap. Isolation is correct. The workload tells you which one you are allowed to prioritise.

India-specific considerations

Two things matter for teams building from India.

Session-billed pricing hits harder where the arbitrage was labour, not compute. An Indian services team competing on cost has usually done it by being efficient with people. Cloud agent runtimes bill in vCPU-hours at rates that do not vary by geography, so an idle-session leak costs a Gurugram team exactly what it costs a San Francisco team. Cost discipline has to move into the code that closes sessions. We covered the wider pattern in our FinOps guidance on AI cloud spend and the AWS FinOps agent preview.

The tenancy question also carries a compliance edge under the Digital Personal Data Protection Act 2023. If an agent session holds personal data of Indian users, the user-to-session binding is not only a correctness bug when it breaks, it is the control that keeps one data principal's information away from another. The Asana pattern, where isolation held but the binding failed, is the exact failure a DPDP-conscious review should be hunting for. Our notes on prompt injection and agent guardrails and MCP server hardening cover the adjacent surface, and agent governance layers covers who is accountable when it goes wrong.

FAQ

How eCorpIT can help

eCorpIT is a CMMI Level 5 certified technology organisation in Gurugram, and our senior engineering teams build and run production agent platforms on AWS, Azure and Google Cloud. We size the isolation decision against your actual workload rather than the vendor's, audit the user-to-session binding that these platforms leave to your backend, and instrument the session lifecycle so idle time does not quietly become your largest line item. If you are choosing a runtime or already paying for one that does not fit, talk to us at /contact-us/.

References

1. Janakiram MSV, The New Stack, AWS, Microsoft, and Google agree the session is the new unit of compute. They disagree on how to isolate it., 26 June 2026

1. AWS, Amazon Bedrock AgentCore pricing, rates listed 18 June 2026

1. AWS, What is Amazon Bedrock AgentCore

1. AWS, Host agent or tools with Amazon Bedrock AgentCore Runtime

1. AWS, Amazon Bedrock AgentCore FAQs

1. AWS, Release notes for Amazon Bedrock AgentCore

1. Cloudflare, Announcing Claude Managed Agents on Cloudflare, 19 May 2026

1. Cloudflare, Cloudflare brings secure, scalable sandboxes to Claude Managed Agents, 19 May 2026

1. Cloudflare, Set up Claude Managed Agents, Sandbox SDK docs

1. Google Cloud, Vertex AI Agent Engine overview

Last updated: 16 July 2026.