It’s not OS-level sandboxing or containers. Each sub-agent is executed as a separate CLI invocation (e.g. Cursor CLI or Claude Code), which means it gets a fre

It’s not OS-level sandboxing or containers. Each sub-agent is executed as a separate CLI invocation (e.g. Cursor CLI or Claude Code), which means it gets a fresh model context window. The isolation is purely at the LLM context level, not process or filesystem isolation. The main agent passes only minimal inputs (file paths, task instructions), gets a concise result back, and keeps its own context clean.