Sandboxing is crowded, and the sandbox itself just got broken
Firecracker VM Escape: PwnEscape Part 2 (50397219) is a detailed write-up of breaking out of the microVM tech that runs on AWS. One commenter noted the article never mentions AWS. Another said they're more convinced every day that the Nova Microhypervisor approach is right: a tiny, formally verified microkernel underneath, with Linux running above it.
The same day, Devvm.dev (50395450), 'one VM for every project', got a skeptical reception. Commenters asked how it differs from sbx and safehouse, pointed to the long list at pleasedonotescape.com, and said Bubblewrap would be lighter. One called the space 'thousands of these so-called sandbox projects'.
The through-line: everyone is building isolation for untrusted code and AI agents, and the strongest isolation primitive on the market just got a public escape. Differentiation among the wrappers is thin, and the foundation under them is not a given.
So what?
If your product runs customer code or agent actions, 'we use Firecracker' is no longer a complete security story. Plan for defense in depth and be honest about your threat model. If you are building yet another sandbox wrapper, say clearly what you do that Bubblewrap and the existing options don't.