“Just run the code” is a security decision

Lesson 1 of 5 in Sandboxing and Computer Use: Isolation for What You Cannot Pre-Approve.

Scoping tools works because you can enumerate the calls: this API, these parameters, that record set. Least privilege is a list.

Then someone adds a code interpreter. The tool schema is one line — run_python(code: string) — and the argument is a program the model just wrote. There is no allowlist for “code.” You cannot review it in advance, because it does not exist until the model emits it, and on the next run it will be different. The same is true of a shell tool, a raw-SQL tool, a package installer, and a browser pointed at the open web.

This is the moment the security question changes shape. It is no longer which call do I permit? It is where does this run, as whom, and what can it reach when it misbehaves? That question has exactly one honest answer, and it is not a prompt.

Interactive sorting exercise: Which of these tool surfaces hand the model arbitrary execution, and which stay bounded by their own schema? Ask one question per card: can the model express a *program* here?

Notice how the sorting exercise splits the two halves of containment. Bounded surfaces are handled by the previous module: fix the shape, fix the scope, gate what is irreversible. Unbounded surfaces are handled here: you stop trying to constrain what runs and start constraining where it runs.

Two properties of the execution environment decide everything that follows. Identity: what credentials does the code inherit — the developer’s laptop keychain, the agent’s task role, or nothing at all? Reachability: what network, filesystem, and kernel surface is in front of it? Follow one tool call through the chain and both questions become concrete.

Where a generated program actually lands

  1. Untrusted content enters context

    A scraped page, an issue comment, a PDF, a tool result. Per OWASP LLM01:2025, indirect prompt injection needs no human-visible text — only content the model parses.

  2. Model emits code or a command

    The model cannot execute anything. It emits a tool-call request whose argument happens to be a program.

  3. Runtime decides where it runs

    The only genuine control point. Everything before this is text; everything after is execution with real authority.

  4. In the agent’s own process / host

    The program inherits the agent’s identity: cloud role, SSH keys, browser cookies, cached tokens, the whole home directory.

  5. In an isolated, ephemeral sandbox

    The program inherits nothing by default. Its filesystem dies with the session and its network is whatever you explicitly allowed.

  6. Egress policy checked

    Can this environment reach the internet, the metadata endpoint, internal subnets? The sandbox is not contained until this answer is written down.

  7. Blast radius = your machine or your account
  8. Blast radius = one disposable box

Key terms: sandboxing, least privilege, prompt injection, egress control, blast radius, tool call

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.