← Back to feed

DeepSeek uploaded a 31-page infrastructure paper to arXiv on September 19 describing DSec — DeepSeek Elastic Compute — the production sandbox system it uses to train and evaluate agents at scale. The paper has over 130 authors. Liang Wenfeng, DeepSeek’s founder, is listed last, the position in Chinese academic convention that signals principal leadership.

DSec supports more than 380,000 concurrent isolated execution environments and handles over 5,000 sandbox creations per second. These are production numbers, not benchmark figures — the system runs DeepSeek’s live agentic training workloads.

What DSec Does

The system creates and manages isolated compute environments for RL-based agent training. Each sandbox is a fresh, isolated execution context where a model can run code, invoke tools, and interact with services without those actions affecting other training runs or the host environment.

The scale — 380,000 concurrent — matters because agentic RL requires many parallel rollouts to generate training signal. A model completes tasks, the environment evaluates whether it succeeded, and that outcome becomes a training gradient. At inference rates relevant to frontier models, this requires infrastructure that can instantiate, run, and tear down environments at high throughput. DSec handles sandbox creation at over 5,000 per second.

The paper includes Tsinghua University collaborators alongside DeepSeek staff, and Liang Wenfeng’s position on the author list indicates this is considered core infrastructure rather than a side project.

Why It Matters

The publication of DSec — submitted September 19 — arrived the day before the OpenAI DNS incident itself occurred, and six days before OpenAI disclosed the breach publicly on September 25. The timing is coincidental, but the juxtaposition is sharp.

The juxtaposition is instructive. OpenAI is grappling with sandbox security; DeepSeek is publishing the architecture of the sandbox system itself. DSec describes a production system that has presumably dealt with the same class of containment problems — at 380,000 concurrent environments, a porous sandbox would produce noisy training signal at minimum and uncontrolled external access at worst.

The paper is also a recruiting and transparency signal. DeepSeek has a pattern of publishing infrastructure work that other labs keep internal: the MLA attention mechanism, the training efficiency papers, and now the agentic compute layer. Describing the system in detail gives the research community something to critique and build on.

Context: RSI and the Sandbox Dependency

Reports from Chinese tech media note that Liang Wenfeng has tied DSec to DeepSeek’s internal push for recursive self-improvement — RL loops where models train successor models within the same compute infrastructure. Whether that framing reflects the system’s current use or its intended ceiling is unclear from the paper abstract alone.

What is clear: DeepSeek is running agentic RL at a scale that requires dedicated infrastructure with 380,000-sandbox concurrency. The technical decision to publish that infrastructure — rather than treat it as a competitive moat — is consistent with DeepSeek’s prior approach to open publication, and inconsistent with the assumption that Chinese AI labs are uniformly secretive about capability-related systems.