The sandboxing note is the part I'd want spelled out further. Blocking outbound network calls and file deletion closes the two failure modes people usually worry about with agent-written code, but the subprocess still shares the notebook's CPU and memory, so a generated turn that's just buggy rather than malicious, an accidental O(n^2) join across 1.5M rows, or a recursive call that never converges, can still eat the capacity's resources for as long as it runs, network-isolated or not. Is there a per-turn CPU or memory cap the harness enforces on its own, separate from the overall 600-second timeout in the example, or does a runaway turn simply run until that outer timeout kills it?
The sandboxing note is the part I'd want spelled out further. Blocking outbound network calls and file deletion closes the two failure modes people usually worry about with agent-written code, but the subprocess still shares the notebook's CPU and memory, so a generated turn that's just buggy rather than malicious, an accidental O(n^2) join across 1.5M rows, or a recursive call that never converges, can still eat the capacity's resources for as long as it runs, network-isolated or not. Is there a per-turn CPU or memory cap the harness enforces on its own, separate from the overall 600-second timeout in the example, or does a runaway turn simply run until that outer timeout kills it?