# FlashVMM – jail your AI agent in a MicroVM that boots in 18 ms > Source: > Published: 2026-11-15 15:09:19+00:00 A sandbox for AI runs: every agent task gets its own FlashVM. It's claimed warm in milliseconds, runs whatever the agent wrote behind a real hypervisor boundary, and is thrown away when the task ends. One install, no account, no cloud. We built our own virtual machine for this: FlashVM, leaner and faster than a conventional microVM. PowerShell as Administrator. It enables the hypervisor if needed, picks x64 or ARM64 and verifies the checksum. ``` irm https://flashvmm.com/install.ps1 | iex ``` Then jail the agent you already use, unchanged: flash agents setup, then cd my-project && claude. It runs in its own VM and sees only that folder. The full tour: flash demo. What it's for Let the agent run anything. Keep your machine. Run code an agent wrote Scripts, package installs, test suites, and Docker builds run inside a VM with its own kernel. Cap CPU, memory, disk and network only when you want to, and decide what it may reach with --egress. Nothing touches the host. flash-mcp hands Claude, Cursor or any MCP client the whole lifecycle in 21 tools: create, run commands, copy files, fork, limit what it can reach, call APIs without holding the key, watch, snapshot, restore, tear down. Warm pools keep spares already running, so a task claims one instead of booting. Snapshots restore a prepared environment in milliseconds, and flash fork branches a running VM into copies that carry on from where it was. A GPU pool loads an AI model on the host's GPU once and every VM you allow sends it requests. No VM touches the GPU or needs a driver, and snapshots and warm pools keep working. Metal on Apple silicon, Vulkan on Linux and Windows. The task takes a warm spare from the pool, or restores a snapshot. No kernel boot on the hot path. 2 Run The agent's commands run in the guest with flash exec; exit code, stdout and stderr come back structured. Files go in and out with flash cp; logs, metrics and events stream back live. 3 Discard The VM is removed when the task ends. Nothing it did carries into the next run, unless you snapshot it. ``` flash claim spare1 --entry 'npm test' # a warm spare from the pool flash logs spare1 flash rm spare1 ``` Same CLI, same HTTP API and same MCP tools on every OS. Full walkthrough → Give it a run. No accounts, no dashboard. A CLI, a hypervisor, and an MCP server.