Daytona Hits a $1 Billion Valuation Selling Sandboxes to AI Agents
The $60 million Series B backs a bet that agents need their own cloud, with machines that boot in milliseconds and a CPU market nobody planned for.
In this article 8 sections
Daytona, a startup selling cloud sandboxes to AI agents, raised a $60 million Series B at a $1 billion valuation on October 20, 2026. FirstMark led the round. The company argues that agents need their own machines, which boot in milliseconds, run unattended, and carry only the access a task requires.
Protocol Wire covers the platforms and tools underneath the software boom, and this deal is a useful window into one of them. This piece is for engineers, infrastructure buyers, and founders who want to understand what an "agentic cloud" really is, and whether the pitch holds up.
What Did Daytona Announce?
Daytona announced a $60 million Series B at a $1 billion valuation, with FirstMark leading. According to Fortune's exclusive on the round, about $50 million came from existing investors, and total funding now stands near $91 million.
The angel list reads like a who's who of developer-tool founders. Stripe's Patrick Collison, Shopify's Tobi Lütke, Perplexity's Aravind Srinivas, Quora's Adam D'Angelo, and Zoom's Eric Yuan all invested. Strategic money came from Qualcomm Ventures, Samsung Next, and Okta Ventures.
The company was founded in 2023 by Ivan Burazin, Goran Draganić, and Vedran Jukić. It first set out to automate software development environments for large enterprises. It then pivoted toward agents, which turned out to need the same thing: a clean, disposable computer on demand.
What Is an Agentic Cloud?
An agentic cloud is infrastructure built for software that acts on its own. Each agent gets a virtual machine where it can write code, browse the web, or run programs. The machine starts in a moment, runs without a person watching, and disappears when the job is done.
This matters because agents are not chatbots. They execute commands, install packages, and open files. Running that on a developer laptop mixes the agent's work with every secret the developer owns. A virtual machine in the cloud keeps working when the laptop is off, and it can be limited to just the access one task needs.
Speed is the product. Burazin says existing clouds take anywhere from 30 seconds to many minutes to start a virtual machine, which is too slow when thousands of agents spin up at once. Daytona says it can configure a new sandbox in 60 milliseconds by pre-distributing machine snapshots onto server drives. Daytona's own site lists a headline figure of under 90 milliseconds, so treat the number as a range until you measure it.
Agents can also fork. Daytona lets an agent clone a running machine, so it can test several approaches in parallel and keep the one that works. That is closer to how a person tries an idea in a branch than to how a script runs in a container.
Who Is Already Using It?
Fortune reports a customer list that includes Anthropic, OpenAI, Nvidia, Cursor, Cognition, Meta, and Cohere. Data-labeling company Snorkel has provisioned more than one million sandboxes on the platform. Those names are the main proof point for the valuation.
Growth is the other proof point. Daytona's revenue run rate grew 25-fold from January to September, an average of 50.9 percent per month. Those are company-provided figures and Fortune does not report the absolute revenue base, so the multiple says more about momentum than about size.
The customer mix fits the market. AI coding tools need a safe place to run generated code, and agent builders need somewhere to put long-running tasks. We covered the coding side in our look at Cognition's $2 billion bet that AI coding is not winner-take-all, and every one of those agents needs a computer to work on.
Why Is the Bet on CPUs, Not GPUs?
Daytona's sandboxes run mostly on CPUs, so the company sits outside the GPU rush. Burazin expects CPU spending to eventually exceed GPU spending, and he predicts a CPU shortage. He describes GPU-focused neoclouds such as CoreWeave and Nebius as a different category.
There is some outside support for the direction. Fortune cites AMD raising its server CPU market growth forecast to more than 35 percent a year, reaching over $120 billion by 2030. That is a forecast from a CPU maker, so read it as a signal, not as proof.
The logic is simple. A model call needs a GPU for a few seconds. The agent that makes the call then spends minutes running tools, tests, and browsers, all on ordinary processors. As agents do more work per model call, the CPU share of the bill grows. Our piece on Gimlet Labs' inference cloud shows the mirror image of this trend on the GPU side.
How Is a Sandbox Different From the Containers You Already Run?
A container shares the host's kernel, while a virtual machine carries its own. That difference matters when the code inside is written by a model and nobody has reviewed it. A kernel flaw in a shared host can let hostile code escape, so teams that run untrusted code usually want a harder boundary.
Speed used to be the argument against full virtual machines. They booted slowly and used more memory. The pitch from Daytona and similar vendors is that snapshots and pre-warmed disks erase most of that penalty, which leaves isolation as a free upgrade.
There is also a state question. Agents often work for hours, and they need files, installed tools, and browser sessions to survive between steps. A sandbox that can pause, resume, and snapshot its state fits that pattern better than a short-lived container job. That is why persistent volumes and long-running machines are featured so prominently on the company's site.
None of this makes containers obsolete. For trusted, short, repeatable jobs, they remain cheaper and simpler. The new category is for the awkward middle: code nobody wrote by hand, running for a long time, with access to real systems.
What Should Infrastructure Buyers Check Before Signing?
Start with isolation and secrets, because that is where agent risk lives. Daytona's site says secrets stay outside sandboxes and are substituted at network egress, so plaintext credentials are not inside the machine. It also says sandboxes can run on customer-managed compute in the customer's own cloud, with Daytona providing the control plane.
Next, verify the numbers on your own workload. Request a pilot and measure cold start, snapshot restore time, and cost per thousand sandbox-hours. Daytona's listed pay-as-you-go pricing is about $0.0504 per vCPU-hour and $0.0162 per GiB of memory per hour, with $200 in free compute, so a pilot is cheap.
Then think about trust at the agent level. A fast sandbox does not decide what an agent is allowed to do inside it. For that question, our report on AIR's $50 million bet on agent background checks covers the permissions side. The two layers work together.
Finally, check the lock-in. Snapshots, volumes, and SDKs make a platform sticky. Ask how you would export an environment and what happens to long-running agents if you move providers. Protocol Wire's editors recommend writing that exit plan before the pilot ends.
What Could Go Wrong With the Thesis?
The biggest risk is the hyperscalers. AWS, Azure, and Google Cloud already have the machines, the customers, and the contracts. Burazin argues they would struggle to rebuild their stacks for agents, but a fast-boot sandbox product is a feature a large cloud can ship.
A second risk is customer concentration. Many of the named customers are model labs and coding-agent companies. If a few of them build sandboxes in-house, growth could slow quickly. A third risk is the usual one for a new category: the term "agentic cloud" is a pitch, and buyers will decide whether it is a real market or a feature.
The company says most of the new money will go to go-to-market sales hiring, plus some engineers. That points to a push toward enterprise buyers, who will want compliance proof. Daytona's site claims HIPAA, SOC 2, and GDPR compliance, which is vendor language that a procurement team will still want to verify with reports.
Conclusion: A Real Problem With a Young Market
The practical answer is that agents do need a safe, fast place to run, and Daytona has real customers and fast growth. A $1 billion valuation still prices in a lot of future. If you build or buy agent systems, run a pilot, measure start time and cost, and plan your exit before you commit.
Also ask who owns agent infrastructure inside your company. In many teams the answer is nobody, because each project quietly picked its own setup. A single owner and a shared standard prevent a dozen unreviewed agent environments from piling up.
Next, map where your own agents run today and what they can reach. If the answer is "a laptop with everything on it," a sandbox review belongs on this quarter's list.
