---
title: "Run code the model writes in a sandbox · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/ai-features-and-agents/sandbox-model-code
id: APS-91
level: Required
applies: ai-features
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 958
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run code the model writes in a sandbox

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-91
- Level: Required
- Chapter: [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md)
- Rule: Run code or commands a model writes only in a throwaway sandbox. It has no secrets, no network and fixed limits on time, memory and disk.
- Check: Ask the feature to run code that prints the environment, reads `/etc/hostname`, calls `https://test.example.org` and loops forever. No secret appears, the request never arrives, and the loop is stopped at the time limit.
- Risk: An account or system taken over
- Applies when: The project uses AI models.
- How: Use a separate container, micro virtual machine or WebAssembly runtime for each run, and delete it afterwards. Mount only the files the task needs, read-only where you can. Turn networking off, or allow a short list of hosts. Never run model code with `eval` or in the app's own process. The [sandbox rule for coding agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox.md) covers agents that write your source code.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
docker run --rm --network none --read-only --memory 256m --cpus 0.5 --pids-limit 64 \
  --user 65534 --cap-drop ALL --security-opt no-new-privileges \
  -v "$PWD/task:/task:ro" sandbox-image timeout 10 python /task/main.py
```

### Python example

```python
# Bad: model code runs inside the app, with its keys and network
exec(model_code)
# Good: a fresh sandbox per run, with a time limit
subprocess.run(["docker", "run", "--rm", "--network", "none", "sandbox-image",
                "timeout", "10", "python", "-c", model_code], timeout=15, check=False)
```

### JavaScript example

```js
// Bad: model code runs inside the app
eval(modelCode);
// Good: a fresh sandbox per run, with a time limit
execFile('docker', ['run', '--rm', '--network', 'none', 'sandbox-image', 'timeout', '10', 'node', '-e', modelCode], { timeout: 15_000 });
```

## Sources

- [OWASP AI Agent Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html)
- [OWASP LLM10:2026 Improper Output Handling](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM10_ImproperOutputHandling.md)

## Related rules

- AID-23 [Run agents in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/sandbox.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/ai-features-and-agents/sandbox-model-code">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep a switch that turns the agent off](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/agent-kill-switch.md)
- Next: [Lock local agent servers to your own machine](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/local-server-origin.md)
- [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md)