Run model-written code in an isolated sandbox

If your agent executes code, assume that code is hostile. It was written by a model that may have read an attacker's instructions.

Run it in a sandbox with:

• no access to your secrets
• a read-only or throwaway filesystem
• CPU, memory and time limits
• network access turned off, or limited to an allowlist

Never run model-generated code in the same process or container as your app server.

Test the sandbox by asking the agent to:

1. read environment variables,
2. reach an internal host,
3. write outside its directory.

All three should fail.