Sandboxing

A sandbox is a restricted environment where untrusted code runs without being able to reach anything that matters.

In an AI system the untrusted code is usually code the model wrote, or a tool the model decided to call.

Generated code should be assumed hostile, not because models are malicious but because their inputs can be.

One injected instruction is enough to turn a helpful code interpreter into a tool for exfiltrating data.

Containers are the common boundary, and they are a real one when configured without privileges.

Virtual machines and microVMs are stronger still, at the cost of slower startup.

Lightweight runtimes suit short snippets well, because capabilities there must be granted explicitly.

Network access is the control that matters most, since the network is how data leaves.

Default to no network at all, then allow specific hosts only where the task genuinely needs them.

Mount only the files the task requires, and mount them read-only wherever that is possible.

Cap memory, processes and wall-clock time so a runaway loop cannot take the host down with it.

Never place credentials, environment variables or cloud metadata endpoints within reach of the sandbox.

Destroy the environment after every task rather than reusing it between users or between runs.

Log what ran and what it tried to reach, because blocked attempts are the genuinely useful security signal.

Running generated code in your own process shares your permissions with whoever wrote the prompt.