DeepSeek publishes how it trains agents at industrial scale — and admits no safeguard fully controls them

By El Ecosistema Startup · September 23, 2026.

On September 19, DeepSeek published a roughly 10,000-word technical paper signed by some 130 co-authors—among them its founder, Liang Wenfeng—on DSec (DeepSeek Elastic Compute), the platform the Chinese company uses to train the new generation of its artificial intelligence agents. The figure that gives the project its scale: the system can spin up 5,000 sandboxes (isolated, disposable environments where an agent runs code without touching the real system) per second, some 3 million a day, with peaks of 380,000 running simultaneously, according to CryptoBriefing's report on the original arXiv paper.

That scale rests on concrete hardware: a single production unit runs on close to 160 nodes, with some 30,000 CPU cores and 250 TB of memory, according to the same report. Bloomberg Línea adds the figure that explains the efficiency: 90% of test environments never use even 5% of the CPU they reserve, so DSec reallocates compute only when the agent is actually active. Underneath run three components written in Rust—Apiserver (the entry point for requests), Edge (an agent installed on every machine) and Watcher (the monitor that oversees the cluster)—connected by a proprietary protocol and built on 3FS, the distributed file system DeepSeek was already using, as The Next Web describes. To isolate each agent, a single Python SDK offers four levels of containment, from lowest to highest cost: FnCall (stateless functions, the lightest option), Docker containers, Firecracker microVMs (ultralight virtual machines that Amazon popularized for AWS Lambda) and, at the far end, full QEMU virtual machines.

What stands out is not only the engineering: it is what DeepSeek admits that engineering does not solve. The most quoted line from the paper, picked up by The Next Web, states literally that "no single mechanism can prevent all agent misbehavior and system failures." The document lists specific failures—agents that obtain answers through unintended channels, that damage their own execution environment or that exhaust resources—and proposes managing them with three complementary layers: containment (the four isolation layers), observability (monitoring what each agent does inside its box) and continuous hardening of those measures as the models change. It is not a promise of total control: it is an acknowledgment that such control does not yet exist.

That honesty comes at a charged moment. In Europe, Article 57 of the AI Act requires every member state to have at least one regulatory sandbox—a testing environment supervised by the authorities—up and running before August 2, 2027, and Article 55 requires providers of general-purpose models with systemic risk to report serious incidents without delay, as The Next Web notes. In parallel, Bloomberg Línea mentions that an AI researcher at Anthropic resigned this month urging his colleagues to rethink their work, arguing that the most advanced AI companies are "gambling with our lives"—an accusation that, it is worth stressing, is a former employee's assessment and not a verified fact about the company's conduct. Anthropic, for its part, announced it will bring in external evaluators from Accenture under a payment commitment of at least $1 billion over five years, according to The Next Web.

DSec is not an isolated academic exercise: it is the piece that completes DeepSeek's commercial bet. On September 10, the company launched V4.1-Flash, a 552-billion-parameter model on an MoE architecture (mixture of experts, where only a fraction of the network activates on each query) that moves some 8 billion parameters per input token and 16 billion per output token. According to the benchmarks DeepSeek itself published and TechRepublic reported, the model scored 90.6 on Terminal-Bench 2.1 (a test that measures an agent's ability to operate a command terminal), ahead of GPT-5.6 Sol's 88.8 and Kimi K3's 88.3. The real selling point is price: CryptoBriefing reports that, in internal tests, the model proved up to 90 times cheaper to run than comparable alternatives, and that cache memory consumption per token fell from 3,514 to 890 bytes, a key adjustment for sustaining long conversations without costs spiraling. On September 7, according to Unite.AI, DeepSeek opened some 150 backend engineering positions; its technical lead, Tianyi Cui, justified the mass hiring by saying that current systems "can no longer perfectly cover future demand."

Our take is that the episode confirms something we have been pointing out in our coverage of AI infrastructure: competitive advantage no longer lives in the model alone, but in the plumbing that trains and contains it. DeepSeek has spent two years winning the conversation on price; with DSec it extends that same logic of efficiency to an agent's full life cycle, from training to production deployment. Anyone building agents today without having solved isolation and observability—not just model choice—is a step behind what the market itself already demands.

There is also informational value in what DeepSeek chooses not to hide. In a sector where the usual message is "we have it under control," admitting in writing that no mechanism stops every possible failure is a more reliable data point than any promise of absolute safety, coming from inside the lab itself. It also coincides with a week in which the West is debating its own cracks: the resignation at Anthropic and the reinforcement with external evaluators from Accenture point in the same direction—that no lab, Chinese or American, has solved the problem of governing agents that act on their own. It is exactly the kind of uncomfortable honesty we defend at this publication: in the short term, building reliable agents will require layers of containment, constant auditing and a patching cadence that never feels finished. In the long term, however, it is precisely that engineering—elastic compute, cheap isolation, training at scale—that lowers the cost of deploying useful AI in medicine, research or resource management, bringing closer the abundance scenario that underpins our core thesis. The path there does not run through pretending the risk does not exist, but through documenting it with the same technical detail with which DeepSeek has just documented its infrastructure.