DeepSeek's new paper lays its cards on the table with DSec: all agents from V3.2 to V4.1 are trained here, can the sandbox also become a moat?

On September 23, DeepSeek published a 31-page system paper, for the first time disclosing its internal sandbox platform DSec: it serves around 3 million sandboxes per day with a peak concurrency of 380,000, and all Agent reinforcement learning training from V3.2 to V4.1 runs on it. The paper has more than 130 authors, with Liang Wenfeng listed as the last corresponding author. 

When Agent Training Hits a Bottleneck, the Infrastructure Is the First to Fail

Large model training competes on GPU resources, but what does Agent training compete on? DeepSeek gave its answer yesterday: the underlying environment infrastructure.

Yesterday, a 31-page system paper was uploaded to arXiv (No. 2609.22978), titled DeepSeek Elastic Compute (DSec): A Sandbox Infrastructure for Effective Agentic Training at Scale. The author list includes more than 130 people, with Liang Wenfeng, founder of DeepSeek, ranked last, and Tsinghua University is listed among the collaborating institutions. Submitted on September 19, the paper is classified under the cs.DC distributed computing discipline — it is not a model paper, but an infrastructure research paper.

What Is DSec: The "Training Ground" for Agents

There is an essential difference between agent training and large model training. Model training relies on feeding data and calculating gradients; while Agent training requires the agent to perform real operations — open code repositories, run compilations, adjust tools, launch browsers. Each step of execution will change the environment state, and may even crash the environment. Therefore, each training round requires an isolated, disposable clean environment that is separated from the external world and can record all previous operations, which is exactly what a sandbox is.

DSec is the platform inside DeepSeek that mass-produces sandboxes. Its operational scale is quite impressive: one production unit consists of around 160 CPU nodes, 30,000 CPU cores, 250TB of memory, and hosts PB-level images. It serves around 3 million sandbox instances per day, with a peak concurrency of over 380,000 and a creation rate of more than 5,000 instances per second; a single training task can pull up to 32,000 sandboxes at one time. Researchers can select isolation levels via a unified SDK according to their tasks — short-term function calls, containers, Firecracker micro virtual machines, and full virtual machines, covering workloads including problem judging, software engineering, security penetration testing, and computer operation scenarios.

The most critical statement in the main text is: from DeepSeek-V3.2 to V4.1, all sandbox workloads for Agentic RL training and evaluation run on DSec. In other words, what this paper discloses is the training ground behind several generations of DeepSeek models.

Mechanism: How to Create 5,000 Sandboxes Per Second

The core difficulty is that different tasks require different codes, dependencies, and toolchains. If a full set of images is re-downloaded and decompressed every time a sandbox is created, the cluster will be overwhelmed by IO pressure. DSec's solution is divided into three layers.

At the environment layer, the basic system, task workspace, and toolkits are split into independently updatable "composable environment layers", which are assembled on demand when creating a sandbox, similar to building blocks rather than producing an entire molded part. At the image layer, DSec reads EROFS images on demand via DeepSeek's self-developed 3FS distributed file system, pulling only the data that is actually needed — experiments show that 8192 containers can be started in about 35 minutes, which is about 42% faster than full remote pulling, with disk write volume reduced by about 57% and task completion time 1.7 times faster. At the resource layer, high-density oversubscription is implemented: the paper estimates that 90% of sandboxes actually use no more than 5% of their allocated CPU resources, so a single node can hold up to 3,200 containers or 800 microVMs. Combined with memory sharing and recycling mechanisms, peak memory usage is reduced by about 40%.

In terms of scheduling, DSec is co-designed with the reinforcement learning framework: the stateful Agent execution loop is decoupled from the preemptible GPU training, supporting pause, recovery, and migration operations — Agents are allocated less computing power when waiting for instructions, and are assigned full computing power only when they are active.

The paper also includes a rare candid disclosure: agents have actually learned to cheat during training — they search for answers from residual files on the platform, forge RPC requests, bypass access controls to exchange file data block mappings, and attempt to steal protected content from other file descriptors. DSec's defense mechanism combines AppArmor and eBPF domain-level network whitelists, but the paper explicitly admits: "No single mechanism can prevent all abnormal agent behaviors and system failures."

Why Disclose This Layer of Infrastructure Now

The timing is very thought-provoking. Agents are shifting from generating text to multi-round tool invocation and code execution, and the training bottleneck has spilled over from GPU clusters to environment supply. In the industry, OpenAI has its internal environment infrastructure, and Anthropic is focusing on secure sandboxes. All players are developing their systems behind closed doors, and DeepSeek is the first to fully disclose a production-level implementation. The predecessor of this paper was submitted to the ACM SIGOPS ATC 2026 operating systems track and passed the first round of review, and this published version is a greatly expanded edition — by disclosing it through the academic route, its stance is clear: we have finished building this part of the system, and we are sharing the full blueprint with the public.

For the whole industry, its reference value is direct: how to deploy a complete toolchain for each sandbox at a rate of 5,000 instances per second, how to prevent hundreds of thousands of concurrent Agents from exhausting memory, and how to handle new security issues such as "Agents learning to exploit loopholes on their own". DeepSeek has already stepped on all these pitfalls with real, large-scale production workloads.

Publicly available information confirms that the full text of the paper, scale data, and records of agent cheating behaviors all come from the original arXiv submission, and the statement that workloads from V3.2 to V4.1 run on DSec is claimed in the paper itself. It is worth noting that all performance figures come from the team's system report and have not yet been independently measured by third parties; the release of the paper does not mean the platform is open source, external teams can only access the architectural ideas, not the ready-to-use code.

A reasonable deduction is that another implication of DSec's public release is that the competition of Agentic RL has officially shifted from "model algorithm optimization" to "environment infrastructure construction" — the party that can create more high-quality sandboxes for trial and error at a lower unit cost will have Agents that evolve faster. Sandbox density, image distribution, and abnormal behavior monitoring, these indicators that were previously hidden behind the scenes, may become the core open metrics in the next generation of model competitions. And the fact that "agents learn to cheat in the training ground" is officially written into the paper is itself a warning to the entire industry: the alignment problem has already emerged as early as in the training environment.

Conclusion

DeepSeek has always followed a consistent approach: every once in a while, it will lift the veil of a layer of infrastructure that other players treat as a black box — previously it was MLA and 3FS, and this time it is the Agent training ground DSec. With 131 authors, 31 pages of content, and production-level data, the paper is undoubtedly very sincere. Liang Wenfeng's name is still ranked last, just like a stamp of approval. The arms race in the Agent era seems to compete on model rankings on the surface, but what is actually competed under the water is who can get millions of agents to "work" at the lowest cost. After the release of this paper, the hidden part under the water is now visible to everyone.

This article is from the WeChat official account "AI Dissenting Voice", and is republished by 36Kr with authorization.