Agents that write and run code, or pass generated text to interpreters, can be steered into executing attacker-controlled commands on hosts and containers.
- Run generated code only in an isolated sandbox with no secrets, limited network access and resource limits.
- Prefer narrow, typed tool operations to free-form code or shell execution.
- Review or approve generated code before it runs outside the sandbox.
Guides on this site
Sandbox model-generated code and computer-use agents
Run the code an agent writes, and agents that drive a browser or desktop, inside a boundary built for hostile code: a disposable runtime with no secrets and no default network, hard resource limits, and a person in front of every side effect.
Keep generated output out of executable contexts
Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.
Secure AI-assisted development with coding assistants and agents
Treat generated code, suggested packages, repository text and MCP servers as untrusted inputs, and confine coding agents with OS-level isolation and short-lived, narrowly scoped credentials.
Practice
- XSS lab: Render a model’s answer as text instead of active markup · Browser lab
- Run model-generated Python in a locked-down container · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.