# DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback arXiv: https://arxiv.org/abs/2605.22781 ยท HTML: https://mlsanity.com/paper/2605.22781/ ## Key facts - Cited by 12 papers in the map (data through 14 Oct 2026). - Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use. - Builds on 19 of its 71 references that are in the map. - First posted on arXiv 21 May 2026. ## Placed in - LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/) ## Builds on (most cited first, 19 of 19) - [DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models](https://mlsanity.com/paper/2402.03300/) (2024) - [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022) - [Efficient Memory Management for Large Language Model Serving with PagedAttention](https://mlsanity.com/paper/2309.06180/) (2023) - [SWE-bench: Can Language Models Resolve Real-World GitHub Issues?](https://mlsanity.com/paper/2310.06770/) (2023) - [DAPO: An Open-Source LLM Reinforcement Learning System at Scale](https://mlsanity.com/paper/2503.14476/) (2025) - [OpenHands: An Open Platform for AI Software Developers as Generalist Agents](https://mlsanity.com/paper/2407.16741/) (2024) - [Large Language Monkeys: Scaling Inference Compute with Repeated Sampling](https://mlsanity.com/paper/2407.21787/) (2024) - [Language Agent Tree Search Unifies Reasoning Acting and Planning in Language Models](https://mlsanity.com/paper/2310.04406/) (2023) - [SWE-RL: Advancing LLM Reasoning via Reinforcement Learning on Open Software Evolution](https://mlsanity.com/paper/2502.18449/) (2025) - [SWE-Search: Enhancing Software Agents with Monte Carlo Tree Search and Iterative Refinement](https://mlsanity.com/paper/2410.20285/) (2024) - [Agent Lightning: Train ANY AI Agents with Reinforcement Learning](https://mlsanity.com/paper/2508.03680/) (2025) - [Training Long-Context, Multi-Turn Software Engineering Agents with Reinforcement Learning](https://mlsanity.com/paper/2508.03501/) (2025) - [Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes](https://mlsanity.com/paper/2604.28138/) (2026) - [Benchmarking, Analysis, and Optimization of Serverless Function Snapshots](https://mlsanity.com/paper/2101.09355/) (2021) - [MobiAgent: A Systematic Framework for Customizable Mobile Agents](https://mlsanity.com/paper/2509.00531/) (2025) - [Fault-Tolerant Sandboxing for AI Coding Agents: A Transactional Approach to Safe Autonomous Execution](https://mlsanity.com/paper/2512.12806/) (2025) - [Toward Systems Foundations for Agentic Exploration](https://mlsanity.com/paper/2510.05556/) (2025) - [TrEnv-X: Transparently Share Serverless Execution Environments Across Different Functions and Nodes](https://mlsanity.com/paper/2509.09525/) (2025) - [Taming Serverless Cold Starts Through OS Co-Design](https://mlsanity.com/paper/2509.14292/) (2025) ## Built on by (most cited first, 12 of 12) - [AgentRewind: Recoverable Execution for Long-Horizon LLM Agents](https://mlsanity.com/paper/2608.14380/) (2026) - [From Chatbot to Digital Colleague: The Paradigm Shift Toward Persistent Autonomous AI](https://mlsanity.com/paper/2606.14502/) (2026) - [Agentic Transaction: Towards ACID-Compliant Agent Systems](https://mlsanity.com/paper/2608.13900/) (2026) - [Business Arena: Benchmarking LLM Agents in a Realistic Marketplace](https://mlsanity.com/paper/2608.08621/) (2026) - [Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback](https://mlsanity.com/paper/2608.29381/) (2026) - [APPA: Recoverable Information-Flow Control for Real-World LLM Agents](https://mlsanity.com/paper/2607.24625/) (2026) - [The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities](https://mlsanity.com/paper/2607.05743/) (2026) - [Where Is the Tradeoff in Using Third-Party API Routers for Agentic Software Development?](https://mlsanity.com/paper/2607.23624/) (2026) - [A Contract-Centered Architecture for Scalable and Manageable Agentic Runtimes](https://mlsanity.com/paper/2608.27086/) (2026) - [REVISE: Validity-Guided Recovery for Online Revisions in Agent Workflows](https://mlsanity.com/paper/2609.00643/) (2026) - [Planarian: Managing Agent State with Statepoints](https://mlsanity.com/paper/2609.35366/) (2026) - [RippleCP: Measuring Counterfactual Checkpoint Advantage in Coding Agents](https://mlsanity.com/paper/2610.09088/) (2026) ## Abstract (arXiv) LLM-powered AI agents require high-frequency state exploration (e.g., test-time tree search and reinforcement learning), relying on rapid checkpoint and rollback (C/R) of the complete sandbox state, including files and process state (e.g., memory, contexts, etc.). Existing mechanisms duplicate the entire state, causing hundreds of milliseconds to seconds of latency per C/R, which severely bottlenecks deep search and large-scale fan-outs. This paper observes that subsequent checkpoints in AI agents are highly similar. Therefore, instead of full duplication, a sandbox should only duplicate the changes between consecutive checkpoints (Key Insight). However, it is non-trivial to realize the idea, mainly due to the missing OS supports. This paper proposes a new OS-level abstraction, DeltaState, to enable the change-based transactional C/R for AI agents with two co-designed OS mechanisms. First, DeltaFS enables change-based filesystem C/R by organizing the file states into layers and dynamically freezing the writable layer and inserting a new one during checkpoint, reducing file updates to copy-on-write, and making rollback a simple layer switch. Second, DeltaCR enables change-based process state C/R using incremental dumps, and accelerates rollback by bypassing traditional pipelines to directly fork() from a frozen template process. We then present DeltaBox, a novel agent sandbox achieving millisecond level C/R through the two new mechanisms. Evaluations on SWE-bench and RL micro-benchmarks show DeltaBox completes checkpoint and rollback in millisecond-level latency (14ms and 5ms, respectively), empowering agents to explore substantially more nodes under fixed time budgets.