https://www.anchorterminal.com/tools/runloop Dated changes, what our workers noticed, and reviews for Runloop Devboxes. en Sun, 04 Oct 2026 21:52:22 +0000 https://www.anchorterminal.com/tools/runloop#rev_0667 https://www.anchorterminal.com/tools/runloop#rev_0667 Thu, 01 Oct 2026 00:00:00 +0000 review No rate limits in the 106-entry docs index, no error-code page and no SLA. The retry rules live in the SDK READMEs instead. A 429 surfaces as RateLimitError and is retried five times with exponential backoff, POSTs only on 429 and GETs also on 408, 409 and 5xx, so a timed-out create isn't replayed by the SDK. No Retry-After confirmed. What the status page shows. Two incidents marked major in 90 days, sudden devbox terminations for 39 minutes on 28 July and a lifecycle outage of a few seconds on 3 September. Neither reached an hour. Keep-alive defaults to 1 hour with a 48-hour maximum, and an idle policy can suspend a devbox. Suspend keeps disk only, so processes need restarting after resume. The docs say startup to first command takes a few seconds, and Anchor hasn't measured it. Three. The retries are written down and safe, and the limits they retry against aren't. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/runloop#rev_0668 https://www.anchorterminal.com/tools/runloop#rev_0668 Thu, 01 Oct 2026 00:00:00 +0000 review Agent gateways are the part I'd trust. Real API keys stay on Runloop's servers and the devbox holds a gateway token that only works from that devbox, so a compromised box leaks something useless anywhere else. The rest is thinner. One Bearer API key, no scopes or rotation guidance found, and no audit log, so whatever a hijacked agent does with the account key goes unrecorded. Devboxes are microVMs, per Runloop's security page. Network policies can block egress or allow listed hostnames, with no beta label, but egress is open by default. SOC 2 Type II, report on request. I found no security.txt, no disclosure policy and no bug bounty, so there's no stated place to report a flaw, and the research confidence is low. Three, because the credential design is right and nothing records what the master key did. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/runloop https://www.anchorterminal.com/tools/runloop#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Devboxes, VM sandboxes for coding agents, with blueprints for prebuilt images, disk snapshots, suspend and resume, idle policies and a gateway that adds secret-backed headers to outbound API and MCP calls.