DeepSeek describes the sandbox platform behind its agent training
Victoria Shinder2 min readDeepSeek has published a technical report on DeepSeek Elastic Compute, or DSec, the sandbox platform it uses to train and evaluate AI agents. The paper, posted to arXiv as 2609.22978 and listing well over a hundred authors, starts from a practical observation: agentic training needs isolated, stateful environments in which a model inspects repositories, calls tools, runs commands and talks to task-specific services, and those environments are created in large bursts, differ in what isolation they need, keep state across long interactions, and come from large image collections with little reuse. The authors argue that this calls for an elastic platform rather than a single sandbox runtime.
DSec exposes four kinds of sandbox through one SDK - function calls, containers, microVMs and full VMs - and schedules placement and lifecycle across the cluster. Environments are composed from independently versioned layers, memory is shared and reclaimed to pack sandboxes densely, and image data is loaded on demand from 3FS, DeepSeek's distributed file system. The platform is designed together with the reinforcement-learning framework: stateful rollouts run separately from preemptible GPU training, sandbox lifecycles are coordinated with training so rollout state survives while idle resources are reclaimed, and the system includes measures against agent misbehaviour such as reward hacking.
The scale figures are the headline. According to the report, a single production unit spans about 160 nodes and serves about 3 million sandboxes a day; in production DSec supports more than 380,000 concurrent sandboxes and sustains over 5,000 sandbox creations per second. The paper notes it is an expanded version of a short abstract that went through review at the ACM SIGOPS ATC operational systems track.
What it means
Most public discussion of training AI agents is about models and reward design. This report is a reminder that the environment the agent acts in is itself a large distributed system, and that its throughput and isolation shape what can be trained. Five thousand environments a second, each isolated and stateful, is a scheduling and storage problem before it is a machine-learning one.
For engineers building agent products, two design choices generalise. Offering several isolation levels behind one interface lets cheap tasks run in lightweight sandboxes and risky ones in full VMs without changing the calling code. And treating reward hacking as something the infrastructure must help contain - rather than only a property of the reward - acknowledges that an agent given a shell will find the shortcuts its environment allows. The figures are DeepSeek's own and describe its production system; they are not an independent benchmark.