The agent doesn't just write the code anymore. It runs it.
That one change broke an assumption a lot of infrastructure was built on. For years, code that ran in production was code a human wrote and another human reviewed. Now an agent generates a script, executes it, reads the result, and generates the next one. Code execution at this scale is already counted in the billions by the platforms leading the category. Most of it lands on shared-kernel containers, on a managed cloud, with no boundary between one workload and the next.
That is the gap CreateOS Sandbox fills. It runs untrusted, AI-generated code in isolated micro-VMs, with real networking, kernel-level egress control, and your own storage. This post is the technical walk-through.
Why a container isn't enough
A container shares the host kernel. Namespaces and cgroups isolate the process, but the kernel underneath is the same one every other container on that host is using. A kernel bug or a container escape is a host compromise.
