The Edge Takes Over: The Infrastructure of Mobile and Lightweight Agents

Arm put the word agent in a hardware launch on September 8, 2026. CSS for Mobile 2, in the company’s words, is an AI-native compute platform designed for the system-level demands of agentic AI and a new generation of cinematic mobile graphics. A processor vendor does not say agentic AI in a launch unless it thinks the term moves silicon. It thinks that now.

The wrinkle is that the agents people already drive from their phones do not run on the phone. Claude Code on mobile executes inside a virtual machine Anthropic operates. A startup called Instinct rents throwaway Ubuntu VMs from a sandbox provider and runs its agent there. Both are mobile agents in the sense that you steer them from a phone. Neither touches the phone’s silicon for the actual work. Two futures are being built at the same time, and they point in different directions.

The box an agent runs in

The most detailed picture of how a consumer mobile agent actually executes comes from a reverse engineer, Rohan Adwankar, who tore into two live systems and wrote up what he found in September 2026. His post is the source for most of the specifics in this section, and I want to flag up front that it is one person’s observation of infrastructure that is not publicly documented and can change without notice. The patterns are what matter; the exact strings may already be stale.

Claude Code on mobile boots into a Firecracker microVM, a KVM guest with its own kernel. The first process is not a shell or an init system. It is a custom Rust program called process_api, running as PID 1, listening on a vsock socket on port 2024 so a host control plane outside the tenant can drive the session. The operator, the thing that actually runs the agent, is sealed inside that guest. PID 1 is non-dumpable. /proc/1/mem is denied even with CAP_SYS_PTRACE. The shell has been stripped of CAP_SYS_RESOURCE.

Inference does not happen on the device. It leaves the box as server-sent events over an egress-only gateway that allows only port 443, with api.anthropic.com pinned in /etc/hosts. There is no inbound path at all. Authentication is a host-minted OAuth token cached root-only and rotated on every boot. Cold boot is roughly 430 milliseconds to init and 6.4 seconds to the harness process.

Instinct takes the opposite posture on one axis and the same on another. It does not run its own VM fleet. It rents E2B sandboxes, which the provider describes as fast Linux VMs created on demand for an agent, and the teardown observed one at 2 vCPUs and 1.9 GB of RAM, about 1.26 seconds to a graphical desktop. The model is not on the box either. The sandbox’s tool calls leave as GraphQL requests to api.instinct.com and run server-side, so there is no inference and no model strings in the sandbox. Browser actions run through a separate pool of cloud-hosted Chrome instances carrying the user’s saved profile, with credentials filled from a server-side vault that never lets a secret transit the sandbox.

The part of Instinct worth the most attention is what it treats as durable, and it is not the machine.

The machine is throwaway, the memory is not

Instinct’s durable state is a git repository of Markdown files that the agent writes itself, commits, and pushes to S3 as a single git bundle keyed by user. There is a timeline/ directory that coarsens over time, raw entries rolled up to hourly, then daily, then weekly. Credentials are short-lived STS tokens, so a leaked sandbox heals itself when the token lapses. The summary line the teardown lands on is the right one: the machine is throwaway, the durable thing is the memory.

This is a genuinely new pattern, and it is the part of the story that matters more than the silicon. In the classic model an agent is a process, and its state is a side effect of that process running. Kill the process and you lose the state, unless someone remembered to snapshot it. Instinct inverts that. The memory is the primary artifact, versioned and portable, and the machine is a disposable surface that executes it for a while. Claude Code keeps the machine durable instead, a writable block volume. Two different answers to the same question, and the question itself is new: what do you keep when you can throw the rest away.

I am not going to re-argue the memory architecture question here. That was a separate post, about vector stores and knowledge graphs. What matters for this one is narrower and more concrete: agent memory is becoming a versioned, portable artifact rather than a side effect of a running process, and that one change ripples outward into where the compute has to live.

The silicon arrives

Arm’s announcement is the hardware half of the same story, and the definition it gives of the workload is worth quoting because it is a definition, not a slogan. An agent has to maintain context, run applications, coordinate models and services, and act on a user’s behalf, all within the power and thermal limits of a smartphone. Arm then names the CPU, not the accelerator, as the orchestration engine that schedules and coordinates that work.

The headline parts are the Mali G2-Ultra NX GPU, Arm’s first with dedicated neural accelerators built into the shader cores, and a C2 CPU cluster that doubles the SME2 units. Arm claims a 70 percent speedup on small language models from that, up to 1.7x higher AI performance and 15 percent higher single-thread performance against the previous generation, at up to 38 percent less power. The Register relays a sharper claim: the GPU renders about an eighth of the pixels and reconstructs the rest, which is how desktop-class graphics fit in a one-watt budget. Every one of those numbers is Arm’s own, not an independent benchmark, and I will say that again in the caveats. The direction is what I find convincing. The silicon is being designed around a workload that was not real two years ago.

The strategic line comes from Arm’s EVP of Edge AI, Chris Bergey: everything you can push to the edge you will. His reasoning is the honest one. Round-tripping every interaction to a datacenter costs latency, connectivity, and money at scale, and all three favor moving the work closer to the user.

The sovereign counterweight

Mistral’s €3 billion Series D, announced around the same time, is the third layer. Post-money valuation north of €21 billion, the largest equity round a European technology company has ever raised, led by Samsung. The framing is a sovereign AI layer: open-weight models plus the infrastructure and compute around them, so a customer is never locked into one vendor’s roadmap, pricing, or availability. Mistral spells out four dimensions of what sovereignty means to it: data that stays inside the organization, models that are controllable and customizable, compute that is private and predictable, and production systems that are auditable.

Applied Compute’s AC2 is the same argument from the infrastructure side. End-to-end infrastructure for training and running open-weight models, with a set of deployment models that shift control toward the customer. You can run fully managed, or bring your own storage so durable data lives in your object store under your own IAM and retention policy, or bring your own compute so workloads run on your Kubernetes cluster inside your VPC, or bring your own harness and connect an existing agent setup through a self-hosted relay.

This layer is what makes the other two usable for the kind of operator this site is written for. I have written about the individual version of sovereignty, a person running their own inference on Apple Silicon. The enterprise version is different in kind, not just scale. It is not a person hedging against a model being pulled. It is an organization deciding where its data, models, and compute are allowed to live, and refusing the default answer of someone else’s datacenter.

Where this leaves the management plane

Put the three layers together and the through-line is the end of the datacenter as the default. Durable state is decoupling from ephemeral compute. The orchestration problem is moving toward the device and toward the customer’s own walls. That is a realignment of where agent intelligence physically lives and who controls it, and it is not the same thing as the governance gap I wrote about earlier this month. That post was about the missing oversight layer around agents that are already running in the cloud. This is earlier. Before you can govern an agent you have to decide where it runs and where its state sits, and that decision is being renegotiated right now by silicon vendors, sandbox providers, and model companies.

The security side is farther along than the governance side, and the details are concrete enough to be worth reading closely. A Firecracker box with a sealed PID 1, egress-only networking, no inbound path, host-minted and rotated credentials, short-lived STS tokens, a credentials vault that never lets a secret touch the box. That is not a whitepaper. It is a real isolation primitive, and it is the beginning of an answer to a question every operator should be asking: how do you secure an agent that runs on a device you do not own, or in a sandbox you rent by the second.

The open question, the one none of these sources answers, is orchestration at the edge. Arm says the CPU becomes the orchestration engine, and that is true at the level of one phone. But nobody has explained how you manage a fleet of edge agents the way a cloud platform manages serverless functions. Who patches a model that lives on a hundred thousand devices. Who observes it. Who revokes its credentials when the engagement ends. Fleet management, patching, revocation, and observability all currently assume the agent is in a cluster you can reach. Move the agent to the edge and that assumption breaks, and the tooling for the new shape does not exist yet. That gap is the part nobody has answered.

Caveats

Several claims here should carry a discount.

The reverse-engineering source is the most important one and the least authoritative. Adwankar’s teardown is careful, and I treat the patterns, microVM isolation, durable-state decoupling, short-lived credentials, as strong. But it is one person’s observation of live systems that are not publicly documented. Treat the exact timings and the internal identifiers as a snapshot, not a spec.

Arm’s performance figures are vendor launch claims, not benchmarks. The 70 percent small-language-model speedup, the 1.7x AI performance, the one-watt graphics budget. Those come from Arm’s announcement and were relayed by The Register without independent testing. And CSS for Mobile 2 is licensed IP, not shipping silicon. Chipmakers still have to build it, and The Register notes devices may not arrive until next year. The agentic era has been announced; it has not shipped.

Mistral’s sovereign framing is company positioning, and the €3 billion figure is self-reported. Largest European equity round is Mistral’s claim. The sovereign narrative is a marketing thesis as much as a technical fact, which does not make it wrong. It makes it unearned until a customer verifies it.

Finally, a definitional note. Mobile and lightweight are doing two different jobs in this story. One meaning is an agent that runs on the phone itself, which is Arm’s bet and mostly future tense. The other is an agent that runs in a provider’s VM but is driven from a phone, which is Claude Code and Instinct and is present tense. Both get marketed as the same shift. They are not. The first moves the compute onto the device. The second moves the durable state out of the datacenter and keeps the compute in a sandbox. I have been explicit about which I mean because the boundary between them is where a lot of the hype lives.

Bottom line

Three infrastructure layers converged in the same week. Disposable sandboxes give an agent a safe, stateless place to execute. On-device silicon makes it practical to run agentic workloads inside a phone’s power budget. An open-weight stack gives operators a way to keep the intelligence loop inside their own walls. They reinforce each other, and together they change the default answer to a question that has quietly been settled in the cloud’s favor for two decades: where does the work actually happen, and who controls the state it leaves behind.

The honest state of it is early. The silicon is not in devices. The sandboxes are rented, not owned. The sovereign stack is a funding round and a set of deployment options. What is real today is the pattern underneath all three: an agent’s durable state is becoming a versioned, portable thing that can be separated from the disposable machine that runs it. That separation is what makes the rest possible. The management plane for a fleet of edge agents is not real yet, and it is the gap worth watching if you run agents that touch data you are responsible for.

Sources

1. The box an agent runs in — Rohan Adwankar, September 2026
2. Inside the Arm Mali G2-Ultra NX GPU — Arm Newsroom
3. Making sovereign, open-weight AI the technology frontier — Mistral
4. Applied Compute Agent Cloud (AC2) documentation
5. Arm introduces new AI-native compute platform built for agentic AI and mobile graphics — Arm Newsroom
6. Arm pushes agentic AI and desktop-quality graphics in next-gen phone platform — The Register
7. AC2 deployment models and architecture — Applied Compute
8. E2B documentation — sandbox-as-a-service