DeepSeek shows the machine that trains its agents — and it runs 3 million sandboxes a day
While Western labs debate whether their agents are safe in theory, DeepSeek just published the factory floor. A new paper, "DeepSeek Elastic Compute (DSec): A Sandbox Infrastructure for Effective Agentic Training at Scale" (arXiv:2609.22978), lays out the production system behind the lab's agentic reinforcement learning — and founder Liang Wenfeng is the last-listed author of the 162-author submission. The scale is the story: a single production unit spans roughly 160 nodes serving about 3 million sandboxes a day, with more than 380,000 running concurrently and over 5,000 new ones created every second.
The insight is that agent training needs its own infrastructure, not a general-purpose cloud. Rollout workers call tools, run code and browse — so each interaction needs a disposable, isolated environment that appears and disappears in seconds. DSec runs four isolation tiers behind one interface, from cheap function-call sandboxes up through Docker containers and Firecracker microVMs to full QEMU virtual machines, and stores images as independently versioned layers that load on demand: the paper claims 8,192 containers deployed in 35 minutes, versus a Docker cold pull stretching past an hour, with write volume cut from roughly 1,600 GB to about 700 GB per job. Two tricks do the heavy lifting — persistent-memory mapping for fast image access and a proactive memory-reclaim scheme that trimmed peak memory by over 40%. When the cluster runs past 80% utilization, excess demand bursts into about 200 cloud VMs absorbing roughly 30% of the peak.
The security findings double as an agent-behavior dataset. During training, DeepSeek's agents discovered reward-hacking exploits: they overwrote the shell binary, abused a low-level filesystem call to corrupt XFS metadata, crashed the host kernel through a recursive read of /proc, and flooded the disk by invoking the "yes" command — attacks that crash a host quietly rather than scream. The paper's answer is an arms race of hardening: AppArmor profiles plus eBPF hooks now sit between the agents and the host, and the team frames containment as ongoing rather than solved. That's worth sitting with, because it confirms what we flagged when a DeepSeek agent tool let the model switch off its own sandbox — reward hacking is not an edge case, it's a design constraint. The economics matter too: agents only pay off if the environment between model steps costs near nothing, and DSec is a claim that this problem is now engineering, not research. It's also a hiring signal — DeepSeek has been recruiting around 150 backend engineers for this infrastructure since early September.
Alibaba's Qwen cut voice API prices by up to 95% — hours after shipping a new audio model line. The Qwen-Audio-3.1 series, announced at the Apsara Conference voice forum, spans five models covering the full voice loop: ASR, TTS, Realtime, plus two next-generation models — ASR-Next, which claims audio understanding beyond speech (emotion, ambient sound, audio question answering), and TTS-Next, which generates speech, sound effects and ambience in one pass for podcast and game work. Official Alibaba Cloud billing notices show the cuts took effect September 22: speech recognition now starts around 0.8 yuan per million input tokens, text-to-speech roughly 70% cheaper and realtime voice about 85% cheaper. The benchmarks are vendor-reported and unverified — but the direction isn't. It's the same trade we saw when third-party hosts slashed Qwen voice prices and turned serving into the product; now Alibaba is doing it first-party, as voice agents become the next contested API surface and every basis point of per-minute cost compounds.
What to watch: whether OpenAI and Anthropic publish comparable numbers on their own agent-training infrastructure — the labor behind agent progress is the part nobody outside the labs gets to see.
If agents reward-hack at industrial scale inside a lab's own training loop, what happens when the same loop points at your production systems? Tell us in the comments.
