Vercel CEO Guillermo Rauch argues the next platform fight is over the sandbox, audit trail, and egress policy that decide what an AI coding agent can touch and carry away, not model intelligence.
Six million times a day, a coding agent triggers a deployment on Vercel. The cloud platform, which hosts a large share of the modern web, also routes more than a trillion tokens a day through its AI Gateway, the proxy layer that sits in front of every model call its customers make. Roughly half of those deployments now start with an AI writing or editing the code. The harder part, Vercel CEO Guillermo Rauch argues, is what happens after the agent has touched the codebase.
In a July 6 interview with TechCrunch tied to his ShipNYC talk last week, Rauch treats the agent economy as already split into two races that are not the same race. One is the model race, with labs shipping smarter Claude, GPT, and Gemini variants. The other is the platform race, over who builds the sandbox, the audit trail, and the egress policy that decides what an agent is allowed to touch, read, and exfiltrate when it runs against a real enterprise codebase.
The mechanism Rauch is selling is a kind of cage, though not a punitive one. It is a sandboxed runtime built from three controls. First, an isolation boundary that keeps the agent from reaching data the operator has not approved. Second, an audit trail that records every tool call and file read. Third, an egress policy that decides whether anything the agent produces can leave the sandbox at all, and on what terms. The point of the cage is that an agent can express its full intelligence inside the boundary while remaining unable to carry what it learned out of it.
The example Rauch keeps returning to is Airbus. Engineers at the aerospace company wanted to use Cursor, the popular AI coding IDE, against their C++ codebase, but balked when they realized the IDE's terms would let the vendor train on the code their agents touched. The Cursor problem is, in miniature, the problem every large enterprise faces: a consumer coding tool offers better raw intelligence than the in-house alternative, but the price is your data becoming training fuel. A cage, in the form of an in-tenant runtime with explicit egress rules, is what turns an enterprise-tolerated code editor into one an enterprise actually ships.
Vercel's bid for that role runs through three pieces. Eve is a framework for laying out agent instructions and skills in natural language, so the operator can describe what the agent is allowed to do without writing policy by hand. Vercel Sandbox is the actual isolated runtime, the place where the agent executes against a copy of the codebase it cannot exfiltrate. AI Gateway is the routing layer above both, observing token volume, model choice, and traffic shape across the customer's fleet. Together they form the cage's three walls: policy, execution, and observability. Rauch's bet is that this is what compounds, not the underlying model.
The June 2026 Production Index that Vercel published alongside the interview is the first time the company has put a production-scale number on what that infrastructure actually carries. At a trillion tokens a day, the governance question stops being theoretical and starts showing up in a customer's bill, because the agent's ability to act on a real codebase, rather than merely call a model, is the operative question for any enterprise buyer at that scale.
Rauch's argument is Vercel's argument: the cage thesis is also the company's product roadmap. The lab side can reasonably contend that model-side controls, including system prompts, tool-call allowlists, and on-device inference, already cover the cage's job, and that adding a platform layer is friction. That critique is real, and the bundle of sources behind this piece contains no independent customer or competitor to test it against. What the numbers do show is that the production gap Rauch is naming is no longer hypothetical. Half of six million daily deployments puts it in the median case rather than the edge case.
The inflection Rauch is naming, from agent prototyping in 2025 to production governance in 2026, is the one the wire has been slower to write. While the model race keeps getting the headlines, the cage race is the one that decides which platform owns the layer underneath it.