From our design notebook: Bubbling AI is in development. This article describes the approach we’re building toward; the service is not open for sign-up.
“The assistant can run code” sounds like one feature. In practice, it asks a harder question: what can that code reach, and who is responsible for stopping it?
Bubbling AI’s cloud sandbox is planned for the Builder plan. It is not available in the product today. A separate local sandbox foundation helps us work through parts of the problem, but local engineering evidence is not the same thing as a live, production service.
What the local foundation explores
The foundation separates a few different kinds of work. Fixed recipes handle tasks such as generating documents. A coding workspace provides a terminal with limits on what it can access and a way to save progress. Browser experiments use a controlled test website, including a simulated form submission that requires confirmation.
Those distinctions matter. A terminal inside a controlled workspace is different from arbitrary access to the computer running it. A simulated reservation is different from logging into a real account. Local tests exercise these defined scopes, and the foundation report records both the evidence and the work that remains.
The boundary has to hold outside the assistant
We design around the possibility that code or an assistant can be wrong. Isolation needs enforcement in the operating environment, with scoped authorization and limits on filesystem access, network traffic, secrets, resources and process cleanup. A command filter or a worktree by itself does not provide that isolation. Provider-management credentials belong in trusted host services, not inside a workload.
That is a design requirement, not a claim that every production condition has already been qualified. The local foundation is not a production deployment or security certification. It does not enable arbitrary real authenticated websites, real account login, general downloads, production confirmation UI or a live cloud provider. Independent security review and other production gates remain outstanding.
What we will call it when it arrives
When the Builder cloud sandbox is ready, its files and snapshots will have their own storage terms. That is different from model processing and from zero-data-retention routing for model providers. We will need to explain those boundaries separately, including what is retained and which provider terms apply.
Until then, the honest description is simple: code execution in the cloud is planned. The local foundation is useful evidence about a bounded design, not a shortcut around the work required to ship and qualify it.
See the Builder plan for the current availability labels, and our privacy and security statement for the distinction between model processing and sandbox storage.