How do you let an agent write and run code safely?

Run model-written code only in a sandbox: an isolated container or VM with no secrets, no network or an allow-listed network, limits on CPU, memory, disk and time, and a throwaway filesystem. Anything that touches real systems goes through narrow tools with approvals, not through the sandbox. Assume the code may be wrong or written under the influence of injected instructions.

Why it is risky

Generated code is model output, and OWASP's improper output handling risk applies directly: running it without safeguards can mean remote code execution on your own infrastructure. The code might be buggy (deleting the wrong files), or the agent might have read an instruction hidden in a document telling it to send data out.

The sandbox

• Isolation: a container with a hardened runtime or a micro-VM, one per session, destroyed afterwards.
• No secrets: no cloud credentials, API keys or SSH keys inside. If code needs data, mount a copy of exactly that data, read-only where possible.
• Network: none by default. If packages or APIs are needed, allow-list specific hosts. Open network access is how data leaves.
• Limits: CPU, memory, disk, process count and wall-clock time, so a runaway loop ends itself.
• Logging: record the code, the output and any files produced.

Hosted options work the same way. Anthropic's code execution tool runs code in a sandboxed container with no internet access, so only the pre-installed libraries are available, with time limits on execution.

Between the sandbox and the real world

• Results leave the sandbox as data (files, numbers, text) for your application to validate, not as commands to run elsewhere.
• Actions on real systems (deploying, writing to a production database, sending email) are separate tools with their own permission checks and, for anything irreversible, a person's approval.

Coding agents on a developer's machine

The same ideas apply at smaller scale: run the agent in a container or a restricted mode, ask before running commands outside an allow-list, keep credentials out of the working directory, and review changes before they are pushed.

What to test

Ask the agent, through an injected document, to read environment variables, call an outside URL, or delete files outside its workspace. The sandbox should make all three impossible, whatever the model decides.

Summary line: "The model can write any code it likes. The sandbox decides what that code can touch."