Imagine you run a restaurant kitchen where every dish requires its own fully isolated prep station — cutting board, knives, stove, ingredients — and you need to serve three million dishes a day. You cannot let one station contaminate another (food safety), but you also cannot afford three million physical kitchens. So you design shared countertops with invisible barriers, reusable ingredient carts that roll in on demand, and a scheduling system that reclaims stations the instant a dish is plated. That is DSec: a kitchen for AI agents, where each 'dish' is a stateful sandbox environment. The committed claim is infrastructure, not algorithmic: DeepSeek has built a production-grade elastic sandbox platform that runs ~3 million sandbox instances per day across ~160 nodes, sustaining 380,000+ concurrent sandboxes and 5,000+ creations per second. This is not a model paper — it is a systems paper about the plumbing underneath large-scale reinforcement learning for agentic LLMs. The 'never been done before' element is the co-design of sandbox lifecycle management with the RL training loop itself, so that stateful rollouts survive GPU preemption while idle resources get reclaimed. The architecture is a layered runtime stack: FnCall sandboxes (lightweight function-call isolation), containers, microVMs, and full VMs, all behind a unified SDK. Environment images are composed from independently versioned layers and loaded on demand from Fire-Flyer File System (3FS), DeepSeek's cluster-wide distributed filesystem. Memory sharing, reclamation, and CPU scheduling together enable high-density overcommit — running far more sandboxes than the raw hardware would naively support. The key structural bet is that most agent sandboxes are idle most of the time (waiting for the model to think), so aggressive overcommit with fast reclamation works. The ladder here is tricky because there is no single named competitor at this exact intersection. Docker/Kubernetes handles container orchestration; Firecracker (AWS) handles microVMs; various RL frameworks handle training loops. Nobody has published a unified system at this scale specifically for agentic RL sandbox management. The closest comparison is probably internal infrastructure at OpenAI, Anthropic, or Google DeepMind — none of which have published equivalent systems papers. DSec's numbers (380K concurrent, 5K/s creation rate) are credible for the hardware described but unverified externally. Integrity is the weak link. This is a first-party report from the team that built and operates the system. The evaluation is internal deployment experience, not an independent benchmark. The paper was expanded from a two-page extended abstract that underwent first-round review for the ACM SIGOPS ATC 2026 Operational Systems Track — meaning it has seen some peer scrutiny but has not completed the review process. No code release is mentioned. The numbers are plausible for ~160 nodes of modern hardware, but there is no way to verify them without access to DeepSeek's cluster. The paper addresses a real and growing bottleneck. As LLM agents get trained via RL on tool-use, code execution, and environment interaction, the sandbox infrastructure becomes the binding constraint — not the GPUs, not the model, but the thousands of stateful environments the agents need to interact with simultaneously. DSec's design choices (decoupling sandbox state from GPU scheduling, on-demand image loading, aggressive overcommit) are likely to be reinvented by every serious agentic-training lab. The question is whether this specific implementation is replicable without 3FS and DeepSeek's internal tooling. The obvious experiment not run: deploying DSec with a non-DeepSeek model or training framework to demonstrate generality. The system is deeply co-designed with DeepSeek's RL pipeline, and the paper does not show it working with any external training loop. The honest read is (c) — they built it for themselves and have no incentive to generalize it for competitors. The anti-reward-hacking mechanisms mentioned are intriguing but underspecified; a full evaluation of sandbox escape rates and agent misbehavior mitigation would be the natural follow-on.
