Alibaba Agent Native Cloud 2026: AgentRun, Loop & Teams

Alibaba Cloud drew a line in the sand at WAIC in Shanghai on July 18, 2026: Alibaba Agent Native Cloud is a re-architected stack whose primitives are agents, not containers. The launch bolts two new layers — AgentLoop for real-time tracing, evaluation and optimization, and AgentTeams for multi-agent orchestration and governance — onto the existing AgentRun runtime, then wraps the whole thing in an “Agentic Computer” sandbox with hard workload isolation and enterprise identity. Agent infrastructure is fragmenting away from generic cloud compute, the way GPU clouds split off from general VMs in 2023. If your team is deciding where production agents live, this is now a three-horse race: Alibaba, AWS Bedrock AgentCore, and Microsoft Foundry Agent Service.

What’s actually new in Alibaba Agent Native Cloud

AgentRun, the serverless runtime Alibaba shipped earlier, was already the interesting piece: session-scoped microVMs that boot in low hundreds of milliseconds, hold state across a multi-turn agent loop, and bill on wall-clock session time rather than per-request. Everything around it was missing. You could run an agent, but you couldn’t see inside it, couldn’t score it, and couldn’t safely let five of them collaborate on one workflow. Agent Native Cloud fills those gaps as first-class platform services rather than a pile of SDK helpers.

AgentLoop

AgentLoop is the agent observability layer, and it’s more opinionated than an OpenTelemetry sink. It captures the full decision trace — model call, tool selection, tool result, retry, state mutation — then lets you attach evaluation sets to live traffic and replay production sessions against a changed prompt or model. The “loop” in the name is the point: traces feed eval, eval feeds prompt and routing optimization, and the platform suggests (or auto-applies, if you let it) cheaper model routing for spans where a smaller model scored identically. Anyone who has hand-rolled a trace-to-eval pipeline with LangSmith plus a homegrown scorer will recognize how much undifferentiated plumbing that removes.

AgentTeams and the Agentic Computer

AgentTeams is the multi-agent orchestration and governance layer. You declare a team as a manifest — members, their tools, a shared workspace, a routing policy — and the platform handles handoff, shared memory, and per-member permission boundaries. The governance half matters more than the orchestration half: each member gets its own identity, its own tool allowlist, and its own spend cap, so a research sub-agent physically cannot call the payments tool. The agent sandbox runtime underneath — the Agentic Computer — gives each session a disposable filesystem, browser, and shell with syscall-level isolation. That’s what makes it defensible to hand an agent a real credential instead of a mocked one.

Why it matters

• Agent infrastructure is now its own category. Billing by session, isolating by task, and tracing by decision are not things generic serverless does well. Expect procurement to treat “agent platform” as a separate line item from compute.
• Observability moved from bolt-on to substrate. Wiring AgentLoop into the runtime means traces are complete by default — no missed spans because someone forgot to instrument a tool wrapper.
• Least-privilege for agents finally has a home. Per-member identity and tool allowlists answer the biggest security objection to multi-agent systems: blast radius when one member gets prompt-injected.
• Pricing pressure on AWS and Microsoft. Alibaba prices aggressively in APAC, and it now has feature parity on the pieces that mattered. Treat it as a credible AWS Bedrock AgentCore alternative in your negotiation, whether or not you deploy on it.
• Regional and regulatory reality. If you serve Chinese or Southeast Asian users, this stack sits inside the compliance perimeter you already operate in. AWS cannot match that by shipping code.
• Portability risk is real. AgentTeams manifests and AgentLoop eval sets are proprietary formats. The runtime speaks standard OpenAI-compatible and MCP interfaces, but the orchestration and eval layers do not port cleanly.

How to use Alibaba Agent Native Cloud today

1. Install and authenticate the CLI. You need an Alibaba Cloud account with the Agent Native Cloud service activated in a supported region — Singapore and Hangzhou at launch.

   npm install -g @alicloud/agentrun-cli
   agentrun login --region ap-southeast-1
   agentrun account show

2. Define a single agent before you reach for teams. The runtime manifest declares the model, the tools, and the sandbox profile. Keep network.egress tight from day one; loosening it later is easy, tightening it after launch is a migration.

   {
     "name": "research-agent",
     "runtime": "agentrun/v2",
     "model": { "id": "qwen3-max", "temperature": 0.2 },
     "sandbox": {
       "profile": "agentic-computer",
       "tools": ["browser", "shell", "filesystem"],
       "network": { "egress": ["api.github.com", "*.arxiv.org"] },
       "session": { "ttlSeconds": 900, "persistState": true }
     },
     "identity": { "role": "acs:ram::agent/research-readonly" }
   }

3. Deploy and smoke-test it. The invoke call returns a session ID you need for tracing.

   agentrun deploy -f research-agent.json
   agentrun invoke research-agent \
     --input "Summarize the three most-cited papers on speculative decoding from 2026." \
     --stream

4. Turn on AgentLoop and attach an eval set. Sampling at 100% during rollout is worth the cost; drop it to 10–20% once the trace shape is stable.

   agentrun loop enable --agent research-agent --sample-rate 1.0
   
   agentrun loop eval create \
     --name research-quality \
     --dataset ./evals/research-golden.jsonl \
     --scorers factuality,tool-efficiency,latency-p95 \
     --attach-to research-agent

   The dataset is newline-delimited JSON with an input and an expected-outcome rubric — not a string match, which matters for open-ended agent output:

   {"input": "Find the current maintainer of the vLLM project.", "rubric": "Names a real GitHub handle; cites the repo; makes at most 3 tool calls."}
   {"input": "Compare FlashAttention-3 and FlashAttention-2 throughput.", "rubric": "Cites benchmark numbers with a source; does not hallucinate a version 4."}

5. Compose a team once one agent is boring. tools is scoped per member — the writer cannot touch the shell, and only the reviewer can approve.

   apiVersion: agentteams/v1
   kind: Team
   metadata:
     name: content-pipeline
   spec:
     routing: supervisor
     supervisor:
       model: qwen3-max
       policy: "Route research first, then draft, then review. Never skip review."
     members:
       - name: researcher
         agent: research-agent
         tools: [browser]
         budget: { maxTokens: 200000, maxToolCalls: 40 }
       - name: writer
         agent: draft-agent
         tools: [filesystem]
         budget: { maxTokens: 120000 }
       - name: reviewer
         agent: review-agent
         tools: [filesystem]
         approvals: ["publish"]
     memory:
       shared: workspace
       retention: session

   agentrun teams apply -f content-pipeline.yaml
   agentrun teams run content-pipeline --input "Draft a brief on agent-native cloud pricing."

6. Read the trace before you trust the output. The --explain flag renders the supervisor’s routing decisions alongside per-member token spend, which is where you find the member quietly burning 80% of your budget.

   agentrun loop trace get --session sess_01J8X... --explain
   agentrun loop eval run --name research-quality --compare-to baseline-2026-07

How it compares

Capability	Alibaba Agent Native Cloud	AWS Bedrock AgentCore	Microsoft Foundry Agent Service
Runtime isolation	Agentic Computer sandbox: microVM, syscall-level, disposable browser and shell	AgentCore Runtime: session isolation, Code Interpreter and Browser tools	Container-based sessions with Azure network integration
Observability	AgentLoop — native tracing, eval sets, replay, auto-routing suggestions	CloudWatch + OTEL spans; eval largely bring-your-own	Foundry Observability with built-in evaluators; Azure Monitor integration
Multi-agent	AgentTeams — declarative manifest, supervisor routing, per-member identity	Multi-agent collaboration with supervisor/collaborator agents	Connected agents and workflows; Semantic Kernel / AutoGen lineage
Model flexibility	Qwen-first; OpenAI-compatible endpoints for external models	Broad model catalog including third-party frontier models	Broad catalog; deepest first-party OpenAI integration
Tool protocol	MCP native, plus managed tool gateway	MCP via AgentCore Gateway	MCP plus 1,400+ connectors via Logic Apps
Best fit	APAC deployments, cost-sensitive scale, teams wanting eval built in	Existing AWS shops needing model breadth	Microsoft 365 and Entra-centric enterprises

What’s next

Watch whether AgentTeams manifests converge on anything portable. Every vendor has invented its own YAML for the same three concepts — members, routing, shared memory — and the industry has already been through this movie with container orchestration. If a neutral spec emerges, and A2A and MCP are the plausible substrates, the orchestration layer commoditizes and differentiation moves entirely to sandbox quality and eval tooling. If it doesn’t, expect real lock-in costs by 2027 for anyone who builds deeply on one vendor’s team model.

Pricing mechanics come second. Session-based billing aligns better with how agents work, but an agent that stalls on a slow tool call costs you real money for doing nothing. Watch for suspend-on-idle semantics — pausing billing while a session waits on a human approval or a long-running external job. Whoever gets that right first has a meaningful cost advantage, and it’s a harder engineering problem than it sounds, because you have to snapshot and restore a live browser and shell.

Finally, watch the eval side of AgentLoop for auto-optimization that actually ships to production. Suggesting a cheaper model for a span is easy; safely promoting that change behind a statistical guardrail is not. The first platform that can demonstrably auto-downgrade 40% of spans without moving a quality metric will reset everyone’s cost expectations — and it will make agent observability, not the runtime, the thing teams pay for.

Frequently Asked Questions

Is Alibaba Agent Native Cloud available outside China?

Yes — Alibaba Cloud International offers it in select regions, Singapore first, with additional APAC and EU regions on the stated roadmap. Availability and feature parity between the China and International editions have historically lagged by a quarter or two, so verify the specific service, not just the region, before you commit.

Do I have to use Qwen models?

No. AgentRun exposes OpenAI-compatible endpoints and speaks MCP for tools, so you can route to external models. The tightest integrations — latency, token accounting inside AgentLoop, auto-routing suggestions — are Qwen-first, and you give up some eval automation when you bring your own model.

How is this different from running agents on Kubernetes?

Kubernetes gives you process isolation and a scheduler. It does not give you session-scoped state that survives a multi-turn loop, per-decision tracing, a disposable browser inside the isolation boundary, or per-member spend caps. You can build all of that — several teams have — but then you maintain an agent platform instead of shipping the agent.

Is the Agentic Computer sandbox safe enough for real credentials?

Safer than a shared container, and that’s the honest framing. Syscall-level isolation plus per-member tool allowlists limits a prompt-injected agent to what its own identity can reach. It does not solve prompt injection itself — scope credentials narrowly, require human approval for irreversible actions, and treat every tool result as untrusted input.

How does the cost compare to AWS Bedrock AgentCore?

Both bill on session duration plus tokens rather than per-invocation. Alibaba is meaningfully cheaper on the compute component in APAC regions, while AWS often wins on total cost for teams already consuming committed-spend discounts. Run your own workload for a week under AgentLoop before believing any published comparison, including this one.

What was announced at WAIC 2026 versus already shipping?

AgentRun predates the July 18, 2026 WAIC announcement and is generally available. AgentLoop and AgentTeams were unveiled at the event, with the Agentic Computer sandbox as the connective tissue. Check current status before architecting around a preview-tier feature — the gap between “announced at WAIC” and “GA with an SLA” is where most migration schedules go wrong.