> Container escapes can however be quite easy

This is certainly true of docker-style container setups where the host kernel is shared directly with other tenants, but it seems to me like a bold claim to make of gvisor as used by these systems.

Both Anthropic and OpenAI have consumer facing products that depend on their ability to run code in a container without falling victim to container escapes - Claude and ChatGPT both use containers as part of regular chats.