---
title: "Run code the model writes in a sandbox · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/sandbox-model-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Run code the model writes in a sandbox

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)
- Rule: Run code or commands a model writes only in a throwaway sandbox. It has no secrets, no network and fixed limits on time, memory and disk.
- How: Use a separate container, micro virtual machine or WebAssembly runtime for each run, and delete it afterwards. Mount only the files the task needs, read-only where you can. Turn networking off, or allow a short list of hosts. Never run model code with `eval` or in the app's own process. The [sandbox rule for coding agents](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/sandbox) covers agents that write your source code.
- Check: Ask the feature to run code that prints the environment, reads `/etc/hostname`, calls `https://test.example.org` and loops forever. No secret appears, the request never arrives, and the loop is stopped at the time limit.

Example:

```sh
docker run --rm --network none --read-only --memory 256m --cpus 0.5 --pids-limit 64 \
  --user 65534 --cap-drop ALL --security-opt no-new-privileges \
  -v "$PWD/task:/task:ro" sandbox-image timeout 10 python /task/main.py
```

```python
# Bad: model code runs inside the app, with its keys and network
exec(model_code)
# Good: a fresh sandbox per run, with a time limit
subprocess.run(["docker", "run", "--rm", "--network", "none", "sandbox-image",
                "timeout", "10", "python", "-c", model_code], timeout=15, check=False)
```

```js
// Bad: model code runs inside the app
eval(modelCode);
// Good: a fresh sandbox per run, with a time limit
execFile('docker', ['run', '--rm', '--network', 'none', 'sandbox-image', 'timeout', '10', 'node', '-e', modelCode], { timeout: 15_000 });
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/sandbox-model-code`.

- Previous: [Keep a switch that turns the agent off](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/agent-kill-switch)
- [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)