A practical guide to sandboxing AI-generated code

You can't trust code your agent wrote

The moment an agent generates and executes code, you've introduced untrusted code into your stack. It might delete a directory, exfiltrate a secret, loop forever and exhaust your resources — not out of malice, but because a model got confused or a prompt got injected.

Running that on your own infrastructure isn't an option. You need a sandbox.

What "sandbox" actually has to mean

A real sandbox for AI-generated code needs four guarantees:

• Isolation — the workload can't touch the host or other workloads. A compromised sandbox stays a compromised sandbox.

• Resource limits — CPU, memory, disk, and time are capped, so a runaway loop can't take everything down with it.

• Controlled egress — you decide what the network can reach. No silent calls to attacker-controlled hosts.

• Disposability — when it's done (or when it misbehaves), you can kill it instantly and leave nothing behind.

Containers vs. microVMs vs. VMs

• Containers are fast and cheap, but they share the host kernel. A kernel exploit escapes the container. Fine for trusted code, risky for untrusted.

• Full VMs give you strong isolation but boot slowly and cost more — painful at scale.

• microVMs are the sweet spot: a real, hardware-isolated VM that boots in milliseconds. VM-grade boundaries at container-grade speed.

For agent-generated code at scale, microVMs are usually the right call.

A safe default

Give every agent its own microVM. Lock egress to an allowlist. Cap resources. Make it ephemeral by default, persistent only when you opt in. Then you can let agents run wild inside the box without the box ever threatening what's outside it.

const agent = await am.create({
  model: "gpt-5",
  isolation: "microvm", // hardware-isolated by default
})

// untrusted, model-written code runs here with zero risk to your infra
await agent.exec("python generated_script.py")

The takeaway

Sandboxing isn't a nice-to-have for agentic systems — it's the thing that lets you ship them at all. Get isolation, limits, egress control, and disposability right, and "the agent ran arbitrary code" stops being the sentence that ends an incident report.

agentmachines runs every agent in its own hardware-isolated microVM by default. Start for free.