Interesting from a Docker perspective, but I’m more interested in it as a sandbox for AI agents and untrusted code execution.

I wrote about that angle here: https://igorstechnoclub.com/sandbox-exec/

Feels like the spiritual successor to sandbox-exec, but with VM-level isolation.

Yes, that article states that as well under limitations: "Deprecation status: While functional, Apple discourages its direct use in favor of App Sandbox for developers."