An AI sandbox is an isolated execution environment for code that an AI model generates or an agent runs. It separates that code from your application and other users' workloads, with controls over accessible resources. Services such as Vercel Sandbox provide these environments through an SDK or API.
An agent answering a question about a spreadsheet may write Python, install a package, and produce a chart. Those actions require a computer with files and processes. The sandbox supplies that computer while your application decides what data and capabilities the code receives.
Copy link to headingWhy does AI-generated code need a sandbox?
Generated code can contain mistakes, follow malicious instructions embedded in its inputs, or exceed the user's request. For example, a dataset summary script might recursively delete its working directory, or a coding agent might run a repository's installation script that reads environment variables.
Running either program in your backend without isolation can expose the backend's files and credentials. Supply task files in a separate execution environment while keeping application credentials and the production filesystem outside it.
The word "untrusted" describes how you treat the code. It doesn't require evidence that the code is malicious. Even code produced by your chosen model needs limits because its behavior depends on prompts, retrieved content, and dependencies that your application may not control.
Code review and automated tests remain useful. They answer questions about the program's behavior; the execution boundary limits what happens while you find out.
Copy link to headingHow does an AI sandbox work?
Your application typically creates a sandbox, supplies task-specific files, and runs a command there. It associates the job with the authenticated user and collects the result when execution finishes.
The user sends a request to the application, which coordinates the agent loop.
The application asks the model for code and receives a program.
The application sends the code and selected input files to an isolated sandbox.
The sandbox runs the code and returns output and files to the application.
The application validates the result before returning it to the user.
For a spreadsheet analysis, your application might upload one CSV file and a generated Python script. The sandbox executes the script and returns a summary or image. Your application checks the output before displaying it, then ends the execution or retains the workspace for a follow-up question.
The isolation mechanism depends on the provider. MicroVMs are small virtual machines with their own operating-system kernels. Other environments restrict programs through mechanisms such as a userspace kernel or a language runtime. Vercel Sandbox uses Firecracker microVMs; each sandbox has a separate filesystem and network environment.
The word "sandbox" alone doesn't tell you which mechanism a product uses or which permissions it grants. For example, Cloudflare offers both Linux containers and Dynamic Workers. Installing a command-line binary requires different runtime capabilities from transforming data through exposed JavaScript methods.
Copy link to headingWhich controls belong around the execution environment?
Isolation establishes a boundary, but the application still chooses what crosses it. Consider a report generator that only needs an uploaded CSV. Giving its sandbox a production database token adds authority that the task never required.
An isolated sandbox can still make outbound internet requests. Vercel Sandbox allows public internet access by default; its firewall policy can deny outbound traffic or limit it to selected destinations. Configure the policy to match the workload before running its code.
Some programs need authenticated API access. Credential brokering can add a secret to an outgoing request outside the sandbox, keeping the raw value away from the program. The program can still use the API permissions those credentials grant, so restrict its operations to the task.
Copy link to headingWhat do developers use AI sandboxes for?
Data analysis is a common fit because the model can generate task-specific transformations without sending every row through its context window. Python processes the dataset, and the model receives the relevant aggregates. You can expose sandboxed analysis through an MCP server to give an agent tools for loading data, querying it, and running Python.
Coding agents need a workspace where they can inspect a repository and run tests. Execution gives the agent evidence that reading source code cannot provide, such as a failing test or a missing dependency. The environment may need to retain edits so the agent can continue after the user returns. Vercel's Sandbox Academy course applies this pattern to a code-review agent.
Platforms also use sandboxes to accept code written by their users. Notion runs each Notion Worker in a Vercel Sandbox microVM, allowing developers and agents to extend workflows with custom code. Its architecture combines execution isolation with credential injection and network policies.
In each case, the agent or user supplies code to run. Your existing backend may be enough for a fixed, trusted function with validated arguments.
Copy link to headingWhat state can an AI sandbox retain?
Keeping a source file for tomorrow is different from resuming a process with an object still loaded in memory. Saving the filesystem alone does not preserve running processes, open connections, or interpreter variables.
Vercel Sandbox persists the filesystem by default. Stopping a persistent sandbox ends its running session and saves filesystem state for a later session. An application can also create a non-persistent sandbox for disposable work. Choose the lifecycle explicitly when handling unrelated users or submissions.
For data that must outlive a sandbox, use storage with an independent lifecycle. Vercel Drives can retain a working directory across sandbox environments. Object storage can hold completed reports and images.
Retained files remain part of the next execution's input. If yesterday's program changed a configuration file or left customer data behind, tomorrow's program can encounter it. Associate persistent workspaces with an authenticated owner and create fresh environments when the trust boundary changes.
Copy link to headingWhat does an AI sandbox leave to your application?
Sandboxing doesn't establish that a result is correct. Generated code can calculate the wrong denominator, omit records, or print a fabricated answer without violating any execution restriction. Validate the results against the task, and keep enough input and code information to reproduce a disputed calculation.
Your application also decides whether an action is authorized. If sandbox code requests another user's file without permission, the receiving service must reject the request. Knowing a sandbox's name or identifier does not prove ownership.
Sandbox output can contain malicious text or markup. Render logs as text, validate structured results, and treat generated files as untrusted when passing them into another system. Applications that process uploads in isolation can run the code in Sandbox and store the results in Blob.
Copy link to headingFrequently asked questions
Copy link to headingIs an AI sandbox the same as a staging environment?
No. Staging is an environment for testing an application before release, often with a copy of its deployment configuration. An AI execution sandbox is designed to contain code whose behavior the application does not trust, so copying production credentials into it would undermine that purpose.
Copy link to headingDoes the AI model run inside the sandbox?
The model can run elsewhere while the sandbox executes its generated code. Your application sends selected files and commands into the sandbox and returns results to the model. Some designs also run the agent process inside a sandbox, which requires separate decisions about protecting the agent's own credentials.
Copy link to headingDoes sandboxing prevent prompt injection?
Sandboxing can limit the actions that follow a prompt injection, but it does not stop a model from following malicious instructions. The application still needs scoped tools and checks on sensitive operations. Restricting files, network access, and credentials reduces what the resulting code can reach.
Copy link to headingDoes sandbox state disappear after every run?
State retention depends on the provider and lifecycle configuration. Sandboxes may preserve files between sessions, restore memory from a snapshot, or discard their state when execution ends. Choose the behavior your application needs and verify exactly what stopping, resuming, and deleting an environment do.