DSPy 3.4.0b1 adds LocalInterpreter and the release notes explicitly refuse to call it a sandbox.

dspy.LocalInterpreter runs generated Python in a persistent subprocess using the current interpreter, giving ordinary Python compatibility without Deno while separating the worker's memory, stdout and lifecycle from the DSPy process. The notes say plainly it is not a security sandbox: generated code keeps the host user's filesystem, environment, credentials, subprocess and network access. execution_timeout counts host-tool time and kills the worker when exceeded but cannot stop a running host callable, whose result is discarded. Default PythonInterpreter is unchanged. Naming the non-guarantee in the release notes is the right move and rarer than it should be.