Current boundary
Capability inputs are temporary objects. Runner callbacks require a shared secret, and user input is not committed into the executor repository.
Execution policy
Providers should use known deterministic commands, explicit source policies, resource limits, and timeouts rather than arbitrary user shell execution.
Internet-scale roadmap
Dedicated builders should run in disposable isolation with CPU, memory, disk, network, and secret boundaries.
Important
The current private preview is an infrastructure prototype, not a general arbitrary-code execution service.