Baseten previews Carbon, Blaxel's microVM sandbox for AI agents

Baseten joins NVIDIA's agent safety push

According to Baseten, agent safety has become a top concern in recent weeks, with attention on where failure modes lie and how to address them. The company says it supports NVIDIA's Agent Safety Platform, which covers three areas: the application layer, runtime, and infrastructure.

Baseten is a launch partner for NVIDIA OpenShell and a member of the Open Secure AI Alliance. It argues that openness is an advantage for AI safety and says it keeps investing in safety controls for the open frontier across inference, training, and sandboxes.

The company points to its recent safety infrastructure effort with Base Labs, Hugging Face, and Goodfire AI. Base Labs develops and publishes methods for training and monitoring open models, and Baseten builds that work into its deployment infrastructure at runtime. Baseten says monitoring only helps if its signals connect to permissions, isolation, and checks before an agent executes code. For agents running on Baseten, it says Blaxel's sandboxes and networking layer are where those controls live.

What Carbon offers

Baseten says it acquired Blaxel to build the cloud for the next trillion agents. Baseten builds infrastructure to train and serve models, while Blaxel provides the execution layer agents need to act: microVM sandboxes, persistent storage, and networking with tight access controls.

Carbon is Blaxel's fourth infrastructure generation. Baseten says it is built to support trillions of agents in production and will come to the Baseten platform soon, where it will back sandboxes and broader execution infrastructure for agentic workflows.

Carbon still runs on microVMs, which Baseten presents as necessary because agents now write and run their own code, making hardware-level isolation a requirement. Every Carbon sandbox gets its own dedicated IPv6 address. Baseten argues that somewhere between billions and trillions of agents will run in parallel this decade, and that IPv6 is the only addressing scheme with room to spare.

The main features shipping with Carbon, according to the company, are:

• Kernel capabilities for agents and runtime enforcement
• Manual snapshotting
• Forking
• A direct path from snapshot to production within milliseconds

Baseten describes Carbon as much more flexible and configurable than any previous generation it built.

OpenShell support and rollback

OpenShell is NVIDIA's open-source runtime that enforces policy at the kernel level. Baseten says it is agnostic to the compute the agent runs on, and that Blaxel supports it.

Because Carbon adds kernel capabilities to the sandbox, it can run heavier runtime software directly inside it. Baseten says this opens the door to a new generation of tooling for frontier agentic AI, including OpenShell. Blaxel built a ready-to-use template that boots a Carbon sandbox with OpenShell already installed.

The snapshots matter for recovery. If OpenShell flags an agent mid-task and quarantines it, Baseten says users can roll back to the last known-good state instantly instead of losing the run.

Availability and what it means

Carbon is in private preview and is rolling out progressively by region and workspace. The full snapshot and fork API reference is in the Blaxel docs. Customers already on 3.0 who want access are asked to reach out to the company. Baseten says upcoming posts will cover security inside and outside Carbon sandboxes, forking and snapshotting workflows, and the application model Carbon makes possible.

For teams running agents that execute their own code, the announcement ties isolation, policy enforcement and state recovery into one sandbox layer. Pricing and general availability dates were not given in the announcement.