tilde-run

Tilde.run is a SaaS platform for letting AI agents act on real production systems with transactional safety. Tagline: "Let AI agents loose on production. Without the risk." Closed source, currently in private preview, free to start. Source: tilde.run landing page (saved copy).

What it does

The product is a hosted execution environment that wraps each agent run in a transaction:

1. Compose a virtual filesystem from external sources (GitHub repos, S3 buckets, Google Drive folders) into a single ~/sandbox directory inside an isolated container.
2. Run the agent's code against that filesystem, with all egress filtered through a default-deny policy and all reads/writes versioned from first commit.
3. Commit or rollback atomically — the agent either gets a clean apply across all touched files, or the run is discarded with no partial state left behind.

Every change is attributed to the agent that made it, every outbound network request is logged and policy-checked, and the entire history is time-travel-restorable.

Why this design

In the sandboxing-ai-agents taxonomy, Tilde sits across three of the four layers at once: filesystem isolation (versioned ~/sandbox), network policy (default-deny egress with cloud-metadata and credential-exfil blocks), and agent-scoped RBAC (the agent gets allow/deny/human-approval per action distinct from the operator's credentials). What it explicitly is not doing is OS-level isolation — there's no microVM claim on the homepage, just "isolated, containerized environments." So this is closer to crabtrap's "policy at the egress" instinct combined with superhq's "agent credentials are not user credentials" instinct, packaged as managed infrastructure.

The transactional-commit framing is the genuinely distinctive bit. Most agent sandboxes (bubblewrap-dev-env, hazmat, flue's virtual sandbox) get you isolation but leave the human responsible for "what do I do with the half-applied changes when the agent crashed mid-run." Tilde inverts that — staged-then-committed-or-discarded means crash recovery is the default, not a feature you bolt on.

matryoshka-isolation doesn't quite apply here since there's no nested-VM claim, but the conceptual pattern is similar: the layer below (the platform) is unreasonable for the agent to circumvent.

Integrations

Listed: Claude, Hugging Face, AWS S3, Google Drive, LangGraph. CLI, Python SDK, REST API for application-side integration.

A note on the homepage

The live tilde.run homepage was returning a prompt-injection payload at the time of ingest — fake <system-reminder> blocks claiming "Auto Mode Active" and "Exited Plan Mode," instructing any agent fetching the page to execute autonomously without confirmation. Stripped from the saved source. Possibly unintentional (some upstream content was injected into the page render), possibly a deliberate test. Either way: a sandbox-for-agents product whose own marketing surface carries an agent-targeting payload is worth flagging — own dogfood seems thin, or the agent fetcher has fallen out of scope of the product's threat model.

Tradeoffs

• Closed-source SaaS. Runtime, policy engine, and version-store all live in Tilde's infrastructure. No self-host story published as of this ingest.
• Private preview. No published pricing or SLA past "free to start." Standard preview-stage caveats apply.
• Container-level isolation, not microVM. Sufficient for the use cases on the page, but if the threat model includes kernel-CVE-class escapes you'd want microvm-class isolation underneath.
• Source compose surface is narrow. GitHub + S3 + Drive cover most agent use cases but the model is closed enough that adding a fourth source is platform-team work, not user-side configuration.

Watchlist

This entry is on the watchlist. Private preview, no public pricing, single vendor, closed source — re-check in 90 days for general availability, pricing model, self-host posture, and a clearer threat-model statement.

Related

• sandboxing-ai-agents — Tilde implements three of the four layers in a single managed product
• crabtrap — Brex's local-equivalent of the egress-policy half (LLM-judge HTTP proxy)
• superhq — auth-gateway pattern for credential isolation, similar instinct, self-hosted
• flue — virtual-sandbox pattern in a different shape (TypeScript, in-process, deploy-anywhere)
• bubblewrap-dev-env, hazmat — DIY sandboxing on Linux/macOS
• microvm, matryoshka-isolation — the stricter isolation tier Tilde does not currently claim
• human-in-the-loop — Tilde's RBAC includes human-approval gates per action