sandboxing

Code-execution agents are powerful and risky: arbitrary model-generated code runs on your infrastructure. The signal is genuine isolation (containers/VMs), resource limits, and network/filesystem restrictions, not 'trust the model.' Here is the answer.

A computer-use agent operates a real browser or desktop via screenshots and clicks. The signal is the perceive-decide-act loop together with the containment for an agent that can click, buy, or delete anything. Here is the answer.

Tool calling costs one LLM round trip per action. Code costs one round trip for a loop over 500 records. The signal is knowing exactly what you trade away when you let the model write the program instead of the call.

A Devin-style agent that carries an issue all the way to a merged PR is the hardest kind to make reliable, since every step can fail and errors pile up. Here is the architecture and the loop that keeps it honest.

Every AI product that runs generated code (notebooks, agents, code interpreters) ends up building this, and the interview turns on two numbers: how strong your isolation is and how fast a session starts. The answer is microVMs plus snapshot restore, and knowing why the VM boot is not the slow part.