MicroVMs for Agents: Why Every Tool Call Deserves It's Own Kernel

Autonomous agents now write and execute code, hit shell tools, and call MCP servers on our behalf - usually inside a shared container with a long-lived identity and open egress. This talk argues the right blast-radius boundary for an untrusted tool call isn't a container, it's a kernel, and shows how to get there with Firecracker microVMs without paying the cold-start tax everyone fears.

Implement agent function calling and tool use in sandbox MicroVM