What changed
Microsoft added Azure Container Apps Sandboxes to the Azure Container Apps extension for Visual Studio Code. Developers can create sandbox groups and sandboxes, execute commands, create named snapshots, inspect status and stop, resume or delete resources from the Azure Resources view.
Why it matters
Disposable execution environments become easier to provision and recover without leaving the editor. The convenience also puts cloud command execution, snapshot retention and deletion behind the developer's extension identity and Azure permissions.
What to do
Install the supported extension in a test subscription, create a least-privilege sandbox group, run a harmless command, snapshot it, stop and resume it, then verify Azure activity logs, billing and deletion before using agent-generated code.
Caveat
The extension is a management surface, not an independent isolation guarantee. Microsoft does not publish a security evaluation in the announcement; operators still need to verify identity scope, network egress, secrets, snapshot retention, cost and teardown.