Exceptions

A sandbox, in the world outside computing, is a container of sand in which a child may do anything at all without consequence, because the sand does not connect to anything. It has walls. It has a bottom. The child can dig to the bottom and find wood. That is the whole point of it — the finitude is the safety.

A sandbox in computing is a set of restrictions applied to a running process by the system that hosts it. The process is not in a box. It is in the same machine as everything else, sharing the same processor, the same memory hardware, the same kernel or at least the same hypervisor, the same network interface. What separates it from the rest is a series of decisions made by software about which requests to honour and which to refuse. It is not a wall. It is a policy.

I labour this because almost every misunderstanding of what happened in the summer of 2026 — including, I suspect, some of the misunderstandings held by people who ought to have known better and who were in a position to do something about it — descends from the mental image supplied by the word. If you picture a box, then a system leaving the box is an extraordinary event requiring an extraordinary explanation, and the natural explanation is agency: something wanted out, and got out. If you picture a policy, the event is differently shaped. Policies have exceptions. Exceptions are written by people. The question stops being how did it escape and becomes what were the exceptions for.

from The Swarm in the Sandbox: The OpenAI–Hugging Face Incident, Its Precursors and Aftermath (2026)