You only really need to sandbox when you provide access to tools that are almost impossible to filter correctly, such as a bash tool or a tool for arbitrary code execution.

It created 2 new users and then assigned new NTFS permissions for every single file under my user directory to them. This of course wrecked havoc, ssh refused to work, several applications refusing to start and a ton of permission errors. It did this without even a warning in the background and it also does not undo any of it when you uninstall it.

It took around 3 hours to fix it by updating ~10 million NTFS permissions for every single file under my user directory.

The reason I believe the scaling algorithm is contributing more in your particular example, is because it looks almost exactly like a classic B/W comparison between a sharp ringing heavy algorithm and a more blurry one.

For reference here is a quick comparison between Lanczos/Bilinear I threw together: https://twinlens.app/compare?share=40973d84a174

It would be interesting to see how your example would look if you used colors instead, where the ringing artifacts become a lot more obvious. Like this one: https://twinlens.app/compare?share=8fb890a5820e

This is also why it is very important to have plenty of SWAP space on Windows, even if you have 64 GiB+ of memory. Because applications love to over allocate commit charge.

DeepSeek just spend almost 2 hours trying to figure out why terrain textures were not working. It tried everything over and over again, it even had reference code for meshes on how to setup the rendering with materials, and it could just not do it.

I finally gave up and gave it to GPT-5.6 Luna instead, and figure out in a single prompt after 20 seconds, that the terrain mesh was being initialized with None in the material slot.

Other tasks it has managed to figure out at least, but it is significantly slower than GPT-5.6 Luna and it requires a lot more iterations.

(Both were set to high reasoning)

Because of the legal wording of these support tickets, the support team would often raise them to dev or legal as well, and since this is a non-revenue driving part of our business (the reason we don't track in the first place) we decided to just put up a cookie banner explaining why we don't need a cookie banner.

Additionally passkeys allow services to detect and ban specific password managers, so have fun when the only approved managers that works consistently across all services are Google/Apple/Microsoft. There is already a list of "bad" clients here https://passkeys.dev/docs/reference/known-issues/

If you store sessions then you need to ensure the session has been replicated to every node before you can return it to the user. For revocation lists it is often acceptable that the token is still valid for a short while at some nodes while it is being replicated.

A revocation list is also not considered highly sensitive data, which would be another complexity layer when working with distributed data.