Europe 2026
Why, and how you need to sandbox AI-Generated Code? — Harshil Agrawal, Cloudflare
Overview
This talk addresses the critical need to sandbox AI-generated code, emphasizing that such code should be treated as untrusted. The core thesis is that while AI can accelerate development, running its output without proper security measures is akin to executing code from an anonymous internet source, posing significant risks. The presentation advocates for applying established sandboxing principles, particularly capability-based security, to mitigate these threats.
Who should watch
- AI Engineers and Developers building with AI-generated code.
- Product Managers evaluating the security implications of AI features.
- Builders concerned about the security risks of LLM-generated code.
- Anyone deploying AI agents that execute code.
Key takeaways
- AI-generated code, regardless of its apparent correctness, should be treated as untrusted due to potential issues like hallucinations, over-helpfulness, or prompt injection.
- Capability-based security, which involves explicitly granting only necessary permissions (allow-listing) rather than trying to block all potential threats (block-listing), is the recommended security model.
- Two primary sandboxing approaches exist: V8 isolates for fast, lightweight, constrained execution (e.g., tool calls, data transformation) and containers for full environment tasks requiring file systems, processes, and package installations (e.g., app building, running servers).
- The decision between isolates and containers hinges on whether the code requires a file system, processes, or package installations; if yes, containers are necessary; otherwise, isolates are preferred for speed and efficiency.
- Key security principles to apply universally include: default deny network access, granting explicit capabilities, isolating per user, setting resource limits, keeping secrets outside the sandbox, cleaning up sandboxes promptly, logging all activity, and validating input before execution.
- Secrets should never be passed directly into a sandbox; instead, proxy sensitive operations through your own worker code.
- Never share sandboxes between users, as this creates a significant data leak vector.
- *AI-generated code is untrusted code. Treat it with the same caution as code from an anonymous contributor.*
Notable quotes
Harshil Agrawal states, *AI-generated code is untrusted code. The same LLM that writes beautiful working React components can be tricked into exfiltrating your database.*
He advises, *Don't enumerate what to block. Enumerate what to allow.*
Unofficial community note. Prefer the recording for nuance.