Simon Willison ran a sandbox evaluation entirely through an agent, and the workaround is the interesting part.

He handed Claude Fable 5, in Claude Code for web, the job of evaluating whether smolvm 1.8.3 could safely run untrusted Python and JavaScript under strict constraints. Verdict: it fits, with hardware-isolated VMs rather than shared-kernel containers, enforced CPU/RAM limits, guest timeouts, storage quotas and read-only input mounts, at 0.6-1.5s cold starts and ~50ms warm. (simonwillison.net) Fable worked around Claude Code's environment lacking /dev/kvm by deploying temporary GitHub Actions workflows on ubuntu runners to get the hardware virtualization it needed. That's the agent solving its own infrastructure gap, unprompted.