A coding assistant is given a tool that lets it write and run arbitrary Python and bash commands to analyze data the user uploads. Rather than running those commands directly on the same machine that hosts the production application and its databases, the system runs each command inside an isolated, resource-limited container with no access to the production network. What is the main reason for running agent-generated code this way?
- It contains the blast radius of any command the model generates -- whether flawed, unexpected, or actively malicious (for example, from data the model was fed) -- so it cannot reach production systems, other users' data, or the internet at large
- It is required because language models are physically incapable of producing syntactically valid Python or bash unless the code executes inside a separate container
- It removes the need for the calling application to read or check the model's generated code at all, since the sandbox itself rewrites unsafe commands into safe ones before running them
- It allows the agent to run commands faster, since sandboxed containers execute code with less overhead than running the same command directly on the host machine
Why A? And why not the others?
Correct answer: A. It contains the blast radius of any command the model generates -- whether flawed, unexpected, or actively malicious (for example, from data the model was fed) -- so it cannot reach production systems, other users' data, or the internet at large
Because the code being run was generated by a model that can be wrong, manipulated by injected instructions in the data it processes, or simply buggy, isolating execution in a sandboxed container with restricted resources and no path to production systems limits how much damage any single generated command can do, regardless of why it went wrong. This is exactly why dedicated code-execution tools for agents describe themselves as running Python and bash in a sandboxed container rather than on the host directly. The option claiming models cannot produce valid code outside a container is wrong -- a model can generate syntactically correct code whether or not that code is ever executed, and containers do not affect what a model is capable of writing. The option claiming a sandbox rewrites unsafe commands into safe ones is wrong because isolation does not modify the code; it only limits what the code, however written, is able to reach and affect. The option about raw execution speed is wrong because sandboxing typically adds overhead rather than removing it; the point of the isolation is containment of risk, not performance.
Source: Anthropic, 'Tool use with Claude' documentation (platform.claude.com/docs/en/agents-and-tools/tool-use/overview), 'Code execution tool' entry: 'Run Python and bash code in a sandboxed container to analyze data and generate files'