Why, and how you need to sandbox AI-Generated Code? — Harshil Agrawal, Cloudflare
Summary
Harshil Agrawal, Senior Developer Advocate at Cloudflare, presents a rigorous technical case for sandboxing AI-generated code, arguing that the industry has broadly ignored fundamental security principles in its rush to ship AI features. The talk opens with a reframing: stripping away AI marketing language, what developers are actually doing is running untrusted code from an opaque source — the LLM — with full production privileges. Agrawal identifies three concrete threat categories.
First, hallucination-driven failures: non-malicious but dangerous outputs such as imports of non-existent packages, recursive functions with no base case, or infinite loops that exhaust compute. Second, the 'over-helpful LLM': an agent asked to configure a database connection may autonomously read environment variables to 'help,' silently exposing API keys and credentials without any adversarial intent. Third, prompt injection — both direct (a user submitting instructions to exfiltrate environment variables) and indirect (adversarial instructions embedded in documents or web pages the LLM reads as part of its task).
The core security principle Agrawal advocates is capability-based security: default deny everything, then explicitly grant minimal, specific capabilities. He contrasts this with blocklist approaches, arguing that enumeration of dangerous operations is necessarily incomplete. The talk then covers two concrete sandboxing solutions built on Cloudflare's platform.
For lightweight, fast tool calls and plugins, Agrawal uses V8 isolates — the same engine powering Chrome tabs — which start in under a quarter millisecond, support JavaScript, TypeScript, Python, and WebAssembly, but provide no file system, no process model, and no network access unless explicitly granted. He demos an OpenClaw alternative where an AI agent generates JavaScript skills that execute in dynamic worker isolates; a single line setting `globalOutbound: null` blocks all outbound network requests, and specific database bindings are passed explicitly rather than exposing the full environment. For heavier workloads requiring a full Linux environment, Agrawal built Prompt Motion (promptmotion.
app), a video generation app where users describe a motion graphic, the AI writes code with npm dependencies, clones a repository, spins up a dev server, and returns a live preview URL — all inside a Cloudflare container managed by a Durable Object. Each user receives a fully isolated container with a separate file system; user A's files do not merely appear permission-denied to user B, they literally do not exist in that container. Agrawal provides a decision tree: if the code needs a file system, processes, or package installs, use containers; otherwise use isolates.
He notes these are complementary — an agent can use isolates for rapid tool-call iteration and switch to a container when it needs to build a deployable application. The talk closes with an eight-item universal checklist applicable to any sandboxing technology: (1) default deny network access, (2) grant explicit minimal capabilities, (3) isolate per user with no sandbox sharing across tenants, (4) set resource limits (CPU, memory, timeouts), (5) keep secrets outside the sandbox and proxy sensitive operations through your own worker, (6) destroy containers immediately after use with try/finally, (7) log all executed code with full audit trails, and (8) validate input before execution with length limits and syntax checks. Agrawal states that following all eight principles puts an application in a 'fundamentally better position than 95% of AI applications running code today.
Key Takeaways
- •Treat AI-generated code as untrusted code from an anonymous contributor — it runs with your full production privileges, including file system, environment variables, network, and database access.
- •Use capability-based security (default deny, explicit allow) rather than blocklists — enumerate what to allow, not what to block, because blocklists will always have gaps.
- •Choose V8 isolates (sub-millisecond startup) for fast, stateless tool calls, plugins, and code interpreters; choose containers (seconds to start, full Linux) only when you need a file system, package installs, or long-running processes.
- •Block all outbound network access by default; in Cloudflare worker isolates a single `globalOutbound: null` setting achieves this — grant network access only if required and route through your own proxy.
- •Never pass API keys or secrets as environment variables into a sandbox; use a proxy pattern where the sandbox calls your worker, which adds authentication headers before forwarding to external services.
- •Enforce strict per-user sandbox isolation — never share execution environments between tenants; a shared sandbox creates a data leak vector where one user's code can access another's files and secrets.
- •Always use try/finally (not try/catch) to destroy containers after use, and set maximum lifetime policies (e.g., 10–30 minutes) to avoid idle containers accumulating cost and security surface.
- •Set resource limits — CPU time caps, memory allocation limits, and execution timeouts — to prevent hallucinating LLMs from triggering infinite loops that cause denial-of-service.
- •Log every execution: what code ran, when, who triggered it, and what it did — audit trails are essential when, not if, something goes wrong.
- Isolates and containers are complementary, not mutually exclusive: use isolates for the agent's rapid tool-call loop and switch to a container when the agent needs to build and deploy a real application.
Transcript
Hey everyone, thanks for being here. I am Hershel. I'm a senior developer advocate at Cloudflare. I spend my days building things with AI and educate and empower others to do so. Today I want to talk about something that sort of keeps me up at night and I suspect once we go through a couple of the slides, some of you will feel the same. Let me start with a question. Now if this was an in-person event, I would have asked you to show off your hands, but just ask this yourself. Have you built somet...
Related Sessions
