The risk in AI code-gen (running untrusted code without isolation)

This is one of the more practical and sobering breakdowns of container (non-)isolation I’ve read in a while. The framing around AI agents deploying code—with access to sensitive API keys—is exactly where modern infra risk is headed, and most teams aren't prepared for it.

What stood out to me is how gVisor and Kata Containers are positioned not as futuristic edge cases but as immediate needs in multi-tenant and AI-integrated environments. You don’t often see platform companies this transparent about the operational pain points (e.g., gVisor syscall support gaps, KVM regressions), which builds trust.

Curious to hear if others here have tried running microVMs in production—especially with orchestration via Kubernetes. Are we at a point where this is viable for most teams, or is the ops overhead still too high?