Very Insightful!
In the Sandbox-as-a-Service work we’re doing, we’re seeing another useful separation: the agent doesn’t have to run where its code executes. It could run on a laptop or in the cloud and access an isolated sandbox through an SDK/API, with IAM, network controls, audit logs and usage metering handled centrally.
It also made me wonder—could “Sandbox vs VM” eventually become a runtime decision rather than a developer decision? The control plane could choose based on how trusted the task is, how long it needs to run, whether state must persist, network access and cost.
Thoughts?