Anecdotally-speaking, I hear that many companies in the LLM agent space roll their own sandbox solutions - I've heard of both Firecracker- and Kubernetes-based implementations.
You kind of need to pretend you are a whole computer for a programming language to be happy. There's built in assumptions they're running on a "real" computer. They assume they've got full access to network and disk. Installing packages often requires compiling C extensions, or running native binaries. All that stuff means the best way to sandbox is to virtualise a whole computer.
It's fun to do it with WebAssembly though, you get a lot of guarantees and it's quite light weight.
check it out: https://e2b.dev
This specific example would make much more sense if it could run sandboxed client-side.
you can also get the raw wasm via our API and run them anywhere you can run Extism[1], the open source wasm runtime & framework that underpins it all. (Including this hyper-mcp project!)
You can also roll your own with selenium and c vision or selectors.