Sandbox
A restricted execution environment that lets code reach only the resources it is authorized for. Browsers, mobile operating systems and Electron sandbox their own processes; for model-generated or other untrusted code, supply the boundary yourself with a hardened container, gVisor, a microVM or WebAssembly, not with restrictions inside the interpreter.
- Also called
- sandboxing · sandboxed
- Defined in
- NIST glossary: sandbox
Covered in
Sandbox model-generated code and computer-use agents
Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.
Convert untrusted office documents and PDFs in an isolated parser
DOCX, XLSX and ODF files are ZIP archives of XML, and PDFs can carry scripts; the converters that read them are large C and C++ programs with a long CVE history. Check the package before any parser reads it, convert each document in a container with no network, no writable root and hard limits, kill it at a deadline, and re-render to pixels when people will open the result.
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Secure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
Constrain desktop IPC and privileged helpers
Keep renderer content, local callers and plugins from turning a narrow feature into unrestricted operating-system access.
Treat model releases as executable supply-chain inputs
Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.
All 11 pages that cover Sandbox in the library
Practice: Local project: Stop untrusted pages from using an Electron bridge · Local project: Convert untrusted documents in a locked-down container · Local project: Run model-generated Python in a locked-down container