Modal's $16B Series D Says the Agent Money Is in Sandboxes, Not Models

Modal is often filed under "serverless GPU cloud," and that is part of its business. But the growth story its own team tells is narrower and more revealing. In the AINews coverage, the company explains: "We launched Sandboxes in 2023 when we noticed that people were using LLMs to generate code. Sandboxes exploded and three years later, it's a $300M run rate."

Put that next to the $1 billion ARR figure and the shape becomes clear. On the reported numbers, sandboxes alone account for something like three tenths of the company's recurring revenue. That is a product whose entire reason to exist is that AI systems now produce code nobody has read yet, and that code has to execute somewhere isolated from everything else.

For a power user, this is the invisible step in almost every interesting agent run. When an agent analyzes a spreadsheet, scrapes and cleans a dataset, tests a fix it wrote, or builds a chart, it is usually generating a script and running it. The quality of that experience depends heavily on:

• How fast an isolated environment can spin up
• How many can run at once without queuing
• How contained a misbehaving script is when it goes wrong

None of those are model properties. A brilliant model with a slow, fragile execution environment produces a slow, fragile agent.

The pattern resembles earlier platform shifts where the unglamorous layer that made a new behavior safe and cheap ended up capturing durable revenue. Modal noticed a behavior (LLMs writing code) before it was a market, built for it, and then rode the agent wave as that behavior went from novelty to default.

The clearest statement of what agent workloads demand came from Modal CTO Akshat at AIE NYC in July. As Latent Space recounts, he described the infrastructure agents need: "millions of concurrent sandboxes, launch RDMA clusters securely and elastically for distributed training, train state of the art speculators for inference, build a whole new sandbox runtime, and more."

Unpack that list from the user's side:

• Millions of concurrent sandboxes means a world where agents are not one chat window at a time but fleets running in parallel, each needing its own disposable machine.
• RDMA clusters, launched securely and elastically is about the high-speed interconnects needed when many GPUs must act like one for training. The word that matters is "elastically": capacity that appears and disappears with demand.
• Speculators for inference refers to techniques that make model responses come back faster. The infrastructure company is doing work that directly affects how responsive agents feel.
• A whole new sandbox runtime signals that existing container technology was not built for this workload, so they are rebuilding the foundation.

That last point carries the thesis. When a company decides it must write a new runtime from scratch, it is saying the existing commodity layer no longer fits the job. In Wardley Mapping terms, sandbox execution for agents has been pulled back from "commodity" toward "custom-built," because the requirements changed faster than the old tools could follow.

This is where the conventional value-capture story starts to wobble. The constraint for agent labor at scale, at least as Modal's growth frames it, is less about whether the model is a few points better on a benchmark and more about whether the system can spawn, isolate, and tear down enormous numbers of execution environments without breaking. Incremental model gains help. But an agent that cannot run its own code at volume is a demo, not a worker.

The usage curve backs the framing. Tripling usage in five months is not what a speculative product looks like. It looks like a dependency.

It would be wrong to read Modal's raise as evidence that model labs are faltering. They are not. On the same day, Simon Willison flagged an FT report that Anthropic told investors its quarterly revenue rose nearly 50% to $16.8 billion ahead of an IPO. In raw dollars, the frontier labs remain the gravitational center of AI spending.

So the interesting question is not "labs or infrastructure." It is why investors are willing to pay a decacorn price for a company that sits underneath the labs' customers rather than competing with the labs directly.

One detail from the same report hints at the answer. Willison notes that Anthropic "has also clamped down on 'distillation'", the practice where rival labs train models on the outputs of more advanced ones. The report adds that when rivals distil from Anthropic's models, "that involves heavy usage and spending."

Read that as an analyst. A model lab has to actively defend its intelligence against being copied through its own API. Its moat is real but porous, and it costs effort to maintain. An execution layer has a different defensive profile: it is agnostic about which model wrote the code. Whether the script came from a frontier model, a distilled rival, or an open-weights model running locally, it still needs a sandbox.

That neutrality is plausibly part of what investors are pricing. Infrastructure that serves every model benefits from model competition rather than suffering from it. The more labs there are, and the cheaper intelligence gets, the more code gets generated and the more execution gets bought.

This is Commoditize Your Complement running in an unexpected direction. Labs would like infrastructure to be a cheap commodity. Infrastructure providers benefit if intelligence becomes the commodity. Modal's growth suggests the second scenario is at least partly playing out, even while lab revenue climbs.

The best case against reading too much into Modal comes from The Sequence's Issue 951, published the same morning. Its author walks through an agent rebooking a trip after a flight cancellation, finding a replacement, checking a calendar, moving a hotel, and getting approval before paying. "The experience feels like one product," the essay observes. "Economically, it is a small supply chain: an application, a model, live data, security controls, and compute."

Then it names the exact framing this piece is flirting with: "Infrastructure owns the scarce resources. Models own the intelligence. Applications own the customer. One of these must eventually eat the others." And it rejects it: "I think that framing is wrong."

That critique deserves a real answer, because it is partly correct. Modal's success does not prove infrastructure will "eat" the model labs or the application layer. Anthropic's revenue makes that obvious. A supply chain view says value spreads across links, and whoever controls a genuinely scarce link captures a share proportional to that scarcity.

Here is where the two views reconcile. The claim worth defending is not that infrastructure wins outright. It is that execution has become one of the scarce links, and that venture capital is now pricing it that way. In the trip-rebooking example, "security controls" and "compute" appear as two items in a list. In practice, for agents that write and run code, they collapse into one thing: the sandbox. That is exactly the slice Modal turned into a $300 million line of business.

So the whole-stack thesis and the infrastructure thesis are less opposed than they look. If the whole stack wins, the question becomes which links are hardest to substitute. Models are increasingly substitutable through routing and distillation. Applications compete on taste and distribution. Safe, elastic, massively concurrent execution turns out to be hard, and hard things command margin.

The Harness Hypothesis this publication returns to often (value sits in what connects the model to the world) fits here. A sandbox is the most literal version of that connection: the place where model output becomes action.

Modal is not the only signal that the agent stack is reorganizing around execution and control rather than raw intelligence. Look at what shipped in open-source agent tooling the following day.

Mastra's October 15 release added scopes to agents: labels that can be passed per call, configured on the agent, or injected by trusted middleware, with the framework merging all three. Memory can be tied to specific resources and conversation threads through those scopes, and resumed runs keep their original scopes rather than picking up new ones. The same release added end-to-end trace aggregation.

Translated for someone who configures agents but does not build frameworks: agents are getting firmer boundaries around what they remember and on whose behalf they act, plus better ways to see what they did across a whole run. A resumed task cannot quietly widen its own permissions. That is a governance feature, not an intelligence feature.

Meanwhile, Langfuse v4.61.0 shipped work to unify trace processing with topic generation and to measure the cost of its own telemetry ingestion paths. Again, the user-facing effect is visibility: understanding what agents are doing and what that observation costs.

Neither release is a funding event. But the pattern resembles what Modal is monetizing at the bottom of the stack, showing up one layer higher. Across the ecosystem, effort is concentrating on:

• Isolation: where agent actions run and what they can touch
• Scoping: who an agent acts for and what it may remember
• Observability: what actually happened during a run

Those are the concerns of an industry moving agents from experiments into ongoing work. They are also the concerns that do not get solved by a better model release. For readers running hosted setups like Claude Managed Agents or self-hosted harnesses, this is the layer where reliability and ai agent security in 2026 will largely be decided.

If investors are right that execution infrastructure is a defensible, high-margin layer, that has consequences for anyone running agents day to day, not just for cap tables.

First, execution becomes a line item you will notice. Many users budget agents around model tokens. Modal's numbers suggest a growing share of agent spend flows to running the code models produce. When estimating something like an openclaw cost per month for heavier workflows, the honest calculation includes sandbox time, not only inference.

Second, provider concentration is a real dependency. A product that grows 3x in usage in five months is becoming load-bearing for many agent products at once. That is good for reliability when it works. It also means an outage, pricing change, or policy shift at a single execution provider could ripple through tools that look unrelated on the surface. When evaluating openclaw alternatives or hosted runtimes, ask where the code actually executes.

Third, sandbox quality is a security question. The whole premise of Modal's Sandboxes, as the company describes it, is running LLM-generated code. Code nobody reviewed is exactly what you want contained. The CTO's emphasis on launching clusters "securely and elastically" and on building "a whole new sandbox runtime" is a reminder that containment is engineered, not assumed. Through a Trust Boundary Model lens, the sandbox is where untrusted model output crosses into real compute, and that crossing is where enforcement belongs.

Fourth, model choice may matter less than you think for some tasks. If the bottleneck for a given workflow is execution (parallel runs, long jobs, data processing), switching to a marginally stronger model may change less than upgrading where and how the agent runs its work. The whole-stack argument cuts both ways here: performance is a supply chain, and the weakest link sets the ceiling.

The broader read on the ai agent business model is that there is no single winner-take-all layer, but there are layers whose scarcity is being repriced. For three years, the industry assumed intelligence was the scarce input. Modal's decacorn moment, landing the same day as record lab revenue, suggests investors now see a second scarce input: the ability to let millions of agents act at once without anything catching fire.