what are the cost and security implications?

Cost is the token usage and container uptime.

One Docker container per-customer sounds like it would be really expensive.

The advantage is per-user memory and self-learning. For context, Claude Managed Agents uses one sandbox per session: https://platform.claude.com/docs/en/managed-agents/environme....

Are they started on-demand, or run 24/7?

24/7 (best for customer-facing chat products).

What keeps users from using the agents for general purpose tasks, protects against prompt-injection, etc?

Users define their agent with a system prompt, tool definitions, and skills (which separate a media generation agent from a people search agent). We use Openrouter which has a prompt injection detection feature: https://openrouter.ai/docs/guides/features/guardrails/prompt....