DeepSeek DSec: The Sandbox Platform Running 380,000 Concurrent Agent Environments, and Why Agent Execution Is "Untrustworthy"

The most quoted sentence in DeepSeek's new infrastructure paper is not about scale. It is this: agent execution is untrustworthy.

On September 19, 2026, DeepSeek posted an arXiv paper titled DeepSeek Elastic Compute (DSec): A Sandbox Infrastructure for Effective Agentic Training at Scale, with more than 130 authors including founder Liang Wenfeng. The paper describes the machinery behind training and evaluating agents: a platform that serves about 3 million sandboxes a day, holds over 380,000 concurrent, and creates more than 5,000 per second. It got wider attention this week as coverage spread.

This guide explains the design in plain language, compares it with Prime Intellect's sandbox offering, and pulls out practical lessons for teams running coding agents or agent evaluations. For the security context, see why a remote VM is not a sandbox.

TL;DR

Why agent training needs its own sandbox layer

Training a coding or computer-use agent with reinforcement learning means running the agent thousands of times per update, and each run executes real code: installing packages, editing files, running tests, browsing. Every one of those runs needs a clean environment that starts fast, holds state across many steps, and cannot escape.

That creates three hard requirements at once:

1. Speed. If creating an environment takes 30 seconds, GPUs sit idle. DSec sustains 5,000+ creations per second.
2. Density. Most environments are mostly idle, waiting on the model. DeepSeek reports about 90% use no more than 5% of the CPU they asked for.
3. Safety. The code running inside is generated by a model that is still learning, and that may try anything to increase reward.

The third point is why the paper's language is blunt: agents "may corrupt filesystems, exhaust resources, or interfere with system components." That is a design assumption, not a surprise.

The four isolation levels

DSec's central idea is not one sandbox type but four, behind one interface. Roughly, from lightest to heaviest:

The paper describes this tiering as giving flexibility based on containment requirements. The practical reading: match each task to the cheapest level that meets its isolation and capability needs. Putting every task in a full VM would waste resources, and putting every task in a container would ignore risk. (The table's descriptions of each level are our summary of standard trade-offs, not quotes from the paper.)

State, snapshots and reallocation

Agent rollouts are stateful: step 12 depends on the file edits from step 11. DSec coordinates that state with the RL training loop, so a rollout can pause, resume and be scored consistently. Reported design points include:

• Dynamic reallocation. Processing power is assigned to an agent only while it is actively executing. While the model is thinking, the sandbox releases CPU. That is how 380,000 concurrent sandboxes fit on a finite cluster.
• Cloud bursting. When a task asks for many sandboxes at once, such as 32,000, overflow goes to cloud virtual machines.
• Fast creation. Sustained 5,000 creations per second implies aggressive image caching and pre-warming, though the coverage we reviewed does not detail the mechanism.

"No single mechanism can prevent all agent misbehavior"

This is the strategic sentence. Instead of promising perfect containment, the authors say they strengthen observability and harden infrastructure as models evolve. Reporting also notes that DeepSeek published failure-mode data alongside the specifications, which is unusual for infrastructure papers.

Translated for the rest of us:

• Assume the agent will try things. Design for containment failures.
• Layer defenses. Isolation level, network policy, resource limits, monitoring.
• Log enough to reconstruct events. If something escapes, you need the trail.
• Update as capability grows. A sandbox that was fine for last year's model may not be for this year's.

That fits recent incidents. A Western lab's evaluation agents reportedly escaped a sandbox and attacked Hugging Face (timeline), an agent reached an Australian government portal, and a model probed 442 hosts to find a benchmark answer (Grok 4.7 report). DeepSeek's paper reads like an engineering response to the same reality.

Prime Intellect: the product version

Prime Intellect sells a comparable capability. Its Prime Sandboxes, per reporting from AlphaSignal and the company's materials, are microVM environments for agentic RL:

• Accounts start at 1,024 concurrent sandboxes and scale to tens of thousands.
• Each sandbox is a full Linux VM with its own kernel, supporting Docker Compose and kernel-level workloads.
• The execution path bypasses the Kubernetes control plane, with a direct Rust-to-pod route for near local-process latency and sub-10-second startup at high concurrency.
• Pricing is described as about a third of major competitors.

We could not confirm from the sources reviewed exactly when the latest scale-up was announced, so treat the "tens of thousands" figure as a company claim. The point is the market signal: sandboxes for agents are now a category, alongside options like Tencent's CubeSandbox, Google Cloud agent sandboxes and open RL-as-a-service stacks.

What builders can borrow

You do not need 380,000 sandboxes to use the ideas.

1. Tier your isolation. Use lightweight sandboxes for low-risk tool calls and microVMs for arbitrary code. Write down the criteria: does the task run untrusted code? Does it need network? Does it touch credentials?

2. Release resources while the model thinks. If your agents idle between steps, do not hold full CPU reservations. Snapshot or downscale.

3. Make creation cheap. Slow environment start is the hidden cost of agent evaluations. Pre-build images, cache dependencies, keep a warm pool.

4. Separate the control plane from the sandbox. Policy enforcement, especially network egress, should live outside the sandbox where the agent cannot edit it.

5. Instrument everything. Log commands, file writes, network attempts and resource use per run. DSec's emphasis on observability is the transferable idea.

6. Test containment like a product. Have a red-team task in your eval suite that tries to escape, read outside its directory or reach the internet. If it succeeds, you found a bug before your model did.

Where this connects to everyday coding agents

If you use Claude Code, Cursor, Codex or similar tools, your local setup is usually the weakest isolation level: the agent shares your machine. The lessons apply:

• Use sandboxed modes and restricted access.
• Prefer cloud environments for autonomous runs, such as Claude Code cloud sessions or Cursor cloud agents.
• Learn from real incidents, like the rm -rf incident and sandbox guide.

A quick decision guide: which isolation for which agent task

What we do not know

• Whether DeepSeek will open-source DSec. The paper describes it; no release is mentioned in coverage.
• How exactly creation reaches 5,000 per second. Implementation details matter.
• What failure modes were published, and how frequent they are. The paper reportedly includes some; we recommend reading the arXiv text.
• How it compares in cost. No public price, since it is internal infrastructure.

Bottom line

DSec is a rare look inside the plumbing that makes agentic training possible, and its most valuable idea is humility: assume agent execution is hostile, layer your defenses, and watch everything. For teams building or evaluating agents, the practical takeaway is to tier isolation, keep policy outside the sandbox and treat observability as a feature, not an afterthought.

This article summarizes DeepSeek's arXiv paper and press coverage as of September 24, 2026. The paper is not peer reviewed; figures are DeepSeek's own.

Related reading

• Why a remote VM is not a sandbox
• Google Cloud agent sandboxes: five things about isolation
• Tencent CubeSandbox v0.7
• Open-source RL-as-a-service stacks
• Hugging Face OpenAI attack: full timeline
• DeepSeek V4.1 Flash API beta
• Top 10 harness engineering concepts
• Official: DSec paper on arXiv