The question

Running an AI coding agent inside a VM is the obvious way to give it real isolation — its own filesystem, its own blast radius, nothing to clean up when you're done. On Apple Silicon that runs into a wall: Apple's Virtualization.framework doesn't pass the host GPU through to a Linux guest, so a model loaded inside the VM is CPU-bound only. Velo Workspaces' answer is AI Bridge — a vsock-based channel that lets the VM reach a model server running on the host's own GPU, exposed inside the guest as a plain OpenAI-compatible endpoint.

The question that actually matters if you're going to rely on this setup day to day: what does that channel cost you? I ran three separate benchmarks, at three different scales, to find out — against MLX, Apple's own array framework, running natively on the Metal GPU via mlx_lm.server.

  • Raw single-request speed — time-to-first-token and sustained throughput
  • Concurrent load — 8 parallel requests, wall-clock time
  • A real agentic coding loop — an actual coding agent (OpenCode) writing and running code against the model, end to end

Setup

  • Host: Mac mini, Apple M4, 10 cores, 16GB RAM, macOS 26.6.2
  • Guest: Ubuntu Server 26.04 LTS VM, 4 vCPU, 4GB RAM — Velo Workspaces' AI Sandbox profile
  • Model: mlx-community/Qwen2.5-Coder-7B-Instruct-4bit, served by mlx_lm.server on the host
  • Protocol: every run was preceded by stopping all VMs and restarting the model server fresh, to rule out leftover contention from a previous run.

Tools

Open source: veloworkspace-tools — ai_perf_test.py, ai_load_test.py, opencode_perf_test.py.

Results

Single-request speed (5-run average)

Bar chart comparing host vs VM single-request speed. Time to first token: 172.21 ms on host vs 174.27 ms via AI Bridge (+1%). Throughput: 24.09 tokens/sec on host vs 23.88 tokens/sec via AI Bridge (-1%).

A ~1% difference in either direction is inside normal run-to-run noise — this is not a measurable cost of the VM boundary.

Concurrent load (8 parallel clients, averaged across 4 runs)

Bar chart comparing host vs VM under 8-client concurrent load. Total wall time: 7.04 seconds on host vs 7.38 seconds via AI Bridge. Average per-client time: 6.24 seconds on host vs 6.39 seconds via AI Bridge.

The VM runs a few percent behind the host here, consistently across all 4 repeated runs — small, but real rather than noise.

Agentic loop (OpenCode, 5 iterations per task, mean)

Bar chart comparing host vs VM on three OpenCode agentic tasks. Math computation: 8.40s host vs 8.82s VM. System info: 4.50s host vs 4.55s VM. File I/O: 5.58s host vs 5.70s VM.

Same pattern: the VM trails by roughly 1–5% across all three tasks, with tight run-to-run variance (standard deviation under 0.2s on every task) — meaning this is a repeatable, low-noise gap, not a fluke of one run.

Conclusion

At single-request scale, routing inference through a vsock proxy into a VM costs nothing measurable — the architecture does what it's supposed to do. Under concurrent load and in a real agentic workflow, there's a small, consistent, low single-digit-percent gap rather than perfect parity — worth stating precisely rather than rounding to zero in either direction.

Practically: if you're running an AI coding agent inside a disposable Linux VM to keep it off your host filesystem, and reaching a model served by MLX on your Mac's own GPU, you're not trading away meaningful inference speed to get that isolation. The vsock hop AI Bridge adds is close to free.

Raw output, methodology notes, and the benchmark scripts themselves are in the repo if you want to reproduce this against a different model or Mac — these numbers are specific to this hardware, model, and workload, and won't necessarily generalize to a 70B model or an 8GB Mac.

Appendix — raw test output

Terminal output from each test, host and VM side by side.

Single-request speed test

Terminal output: ai_perf_test.py running on the host, showing average TTFT 172.21 ms and average throughput 24.09 tokens/sec. Terminal output: ai_perf_test.py running inside the VM over AI Bridge, showing average TTFT 174.27 ms and average throughput 23.88 tokens/sec.

Concurrent load test

Terminal output: ai_load_test.py running on the host with 8 parallel clients, total wall time 7.04s, avg client time 6.24s. Terminal output: ai_load_test.py running inside the VM over AI Bridge with 8 parallel clients, total wall time 7.38s, avg client time 6.39s.

Agentic-loop latency test (OpenCode)

Terminal output: opencode_perf_test.py running on the host, showing mean times of 8.40s, 4.50s, and 5.58s for the three tasks. Terminal output: opencode_perf_test.py running inside the VM over AI Bridge, showing mean times of 8.82s, 4.55s, and 5.70s for the three tasks.