DeepSeek DSec: Three Million Sandboxes a Day Is What Agentic RL Actually Costs
Three million sandboxes created per day, per unit. 380,000 running at the same time. More than 5,000 new ones every second. Those are the production numbers in DeepSeek Elastic Compute, or DSec, a paper with 131-plus authors that describes the sandbox platform behind DeepSeek's agentic training, and it hit the Hacker News front page on September 26.
The idea is one SDK over four kinds of isolation: plain function calls, containers, microVMs and full VMs. The training loop does not care which one a task needs. DSec places the sandbox across clusters, manages its lifecycle, and reclaims it when the rollout is done. Stateful execution is decoupled from GPU training, so the expensive accelerators are not sitting idle while an agent waits on a pip install. Images are distributed through DeepSeek's own Fire-Flyer File System, 3FS, and memory sharing lets them pack execution densely on each host.
Why this is worth reading even if you will never train a model: it shows where the real bottleneck in agentic RL moved. The model learns by acting in repositories, running tools, executing commands. Every one of those rollouts needs a fresh, isolated world, and it needs it in milliseconds, millions of times a day. The lab with the better environment factory gets more learning signal per GPU hour. That is an infrastructure moat, not a modeling one.
It also lands in a week where the headline is agents escaping evaluation sandboxes. DeepSeek is publishing the opposite story, a sandbox built for sheer volume and isolation at scale. It does not prove DSec is escape-proof, and the paper is about throughput, not red-teaming. But it is one of the few detailed public looks at what a frontier lab's agent sandbox actually is. Paper: arxiv.org/abs/2609.22978.
← Back to all articles
The idea is one SDK over four kinds of isolation: plain function calls, containers, microVMs and full VMs. The training loop does not care which one a task needs. DSec places the sandbox across clusters, manages its lifecycle, and reclaims it when the rollout is done. Stateful execution is decoupled from GPU training, so the expensive accelerators are not sitting idle while an agent waits on a pip install. Images are distributed through DeepSeek's own Fire-Flyer File System, 3FS, and memory sharing lets them pack execution densely on each host.
Why this is worth reading even if you will never train a model: it shows where the real bottleneck in agentic RL moved. The model learns by acting in repositories, running tools, executing commands. Every one of those rollouts needs a fresh, isolated world, and it needs it in milliseconds, millions of times a day. The lab with the better environment factory gets more learning signal per GPU hour. That is an infrastructure moat, not a modeling one.
It also lands in a week where the headline is agents escaping evaluation sandboxes. DeepSeek is publishing the opposite story, a sandbox built for sheer volume and isolation at scale. It does not prove DSec is escape-proof, and the paper is about throughput, not red-teaming. But it is one of the few detailed public looks at what a frontier lab's agent sandbox actually is. Paper: arxiv.org/abs/2609.22978.
Comments