---
title: How to execute AI-generated code safely with Vercel Sandbox
description: Learn how to run code generated by AI models in an isolated sandbox environment.
url: "https://vercel.com/kb/guide/how-to-execute-ai-generated-code-safely"
published: 2026-01-27
last_updated: 2026-09-24
authors: Allen Zhou, Amy Burns
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

When you let AI models generate and execute code, you need a secure execution environment. The AI might produce code that consumes excessive resources, accesses sensitive files, makes unwanted network requests, or runs destructive commands.

[Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) provides isolation, resource limits, and automatic timeouts that make it safe to run untrusted code. This guide shows you how to build an "AI code runner" that takes a task, generates code using the [AI SDK](https://ai-sdk.dev) with [AI Gateway](https://vercel.com/docs/ai-gateway), and executes it in a sandbox.

## Prerequisites

Before you begin, make sure you have:

- Vercel CLI installed (`pnpm install -g vercel`)
  
- Node.js 22 or later
  
- A [Vercel project](https://vercel.com/docs/projects) to link your sandbox to and generate an OIDC token
  

## 1\. Project setup

Create a new directory and install dependencies:

```bash
mkdir ai-code-runner
cd ai-code-runner
pnpm init
pnpm add @vercel/sandbox ai ms zod dotenv
pnpm add -D @types/node
```

## 2\. Set up authentication

Link your project to Vercel and pull the OIDC token. This token authenticates both Sandbox and [AI Gateway](https://vercel.com/docs/ai-gateway):

```bash
vercel link
vercel env pull
```

## 3\. Create the script

Create a file called `index.ts` and add the code below. The script:

1. Takes a task description from the command line
   
2. Sends it to Claude via AI Gateway
   
3. Writes the generated code to an isolated sandbox
   
4. Executes it and captures the output
   

````typescript
import ms from 'ms';
import { generateText } from 'ai';
import { Sandbox } from '@vercel/sandbox';
import dotenv from 'dotenv';

dotenv.config({ path: '.env.local' });

const SYSTEM_PROMPT = `You are a code generator. Write JavaScript code that runs in Node.js.

Rules:
- Output ONLY the code, no explanations or markdown
- Use only standard Node.js features (no external packages)
- No file system access (no fs module)
- No network requests (no fetch, http, etc.)
- No process.env access
- Code must complete within 10 seconds
- Use console.log() to output results`;

async function generateCode(task: string): Promise<string> {
  const { text } = await generateText({
    model: 'anthropic/claude-sonnet-5',
    system: SYSTEM_PROMPT,
    prompt: `Write JavaScript code to: ${task}`,
  });

  return text
    .replace(/^\s*```(?:javascript|js)?\s*/i, '')
    .replace(/\s*```\s*$/i, '')
    .trim();
}

async function executeCode(code: string): Promise<{ output: string; exitCode: number }> {
  const sandbox = await Sandbox.create({
    resources: { vcpus: 2 },
    timeout: ms('2m'),
     image: 'vercel/sandbox/node:24',
  });

  try {
    await sandbox.writeFiles([
      { path: '/vercel/code.mjs', content: Buffer.from(code) },
    ]);

    const result = await sandbox.runCommand({ cmd: 'node', args: ['code.mjs'] });

    const stdout = await result.stdout();
    const stderr = await result.stderr();

    return { output: stdout || stderr || '(no output)', exitCode: result.exitCode };
  } finally {
    await sandbox.stop();
  }
}

async function main() {
  const task = process.argv.slice(2).join(' ').trim();

  if (!task) {
    process.exit(1);
  }

  console.log(`Task: ${task}\n`);

  const code = await generateCode(task);

  console.log('Generated code:\n');
  console.log(code);
  console.log('\nRunning in sandbox...\n');

  const { output, exitCode } = await executeCode(code);

  console.log('Output:\n');
  console.log(output);

  process.exitCode = exitCode;
}

main().catch((error) => {
  console.error(error instanceof Error ? error.message : String(error));
  process.exit(1);
});
````

## 4\. Run the script

Run the script with a task description:

```bash
pnpm dlx tsx index.ts "Calculate the first 20 Fibonacci numbers"
```

Expected output:

```bash
Task: Calculate the first 20 Fibonacci numbers

Generated code:

function fibonacci(n) {
  const result = [];
  if (n >= 1) result.push(0);
  if (n >= 2) result.push(1);

  for (let i = 2; i < n; i++) {
    result.push(result[i - 1] + result[i - 2]);
  }

  return result;
}

console.log(fibonacci(20));

Running in sandbox...

Output:

[
  0, 1, 1, 2, 3,
  5, 8, 13, 21, 34,
  55, 89, 144, 233, 377,
  610, 987, 1597, 2584, 4181
]
```

Try other tasks:

```bash
pnpm dlx tsx index.ts "Find all prime numbers under 100"
pnpm dlx tsx index.ts "Implement quicksort and sort [64, 34, 25, 12, 22, 11, 90]"
pnpm dlx tsx index.ts "Reverse each word in 'Hello World from Sandbox'"
```

## Safety layers

The script uses multiple safety layers to handle untrusted code:

**Sandbox isolation**: Each execution runs in a fresh microVM with limited resources and a short timeout. If the code hangs or tries to use too much memory, the sandbox terminates it.

**Prompt constraints**: The system prompt instructs Claude to avoid dangerous operations: no file system access, no network requests, no environment variables. While not foolproof, this reduces the likelihood of problematic code.

**Error capture**: The sandbox captures both stdout and stderr, so you can inspect failures without them affecting your host system. To investigate memory-heavy generated code, inspect the sandbox’s Memory Usage chart against its configured limit and 85% warning line. Use it alongside stdout and stderr when investigating a failed run.

## Next steps

- Add [snapshots](https://vercel.com/docs/vercel-sandbox/managing#snapshotting) to speed up repeated executions
  
- Use [Sandbox.get()](https://vercel.com/docs/vercel-sandbox/sdk-reference#sandbox.get) to reuse sandboxes across requests
  
- Explore [AI SDK](https://ai-sdk.dev) features like streaming and tool calling
  
- Learn about [AI Gateway](https://vercel.com/docs/ai-gateway) model routing and fallbacks

## More Vercel Sandbox guides

- [Private enterprise agents on Vercel](/kb/guide/private-enterprise-agents-vercel): Design private enterprise agents that call internal APIs and databases with Vercel Functions, Secure Compute, AI Gateway, Workflows, and Vercel Connect.
- [Run recurring security reviews with deepsec on Vercel](/kb/guide/deepsec-reviews-on-vercel): Learn how to run periodic security scans on your code with deepsec. Set up deepsec to review GitHub repositories and deliver findings to GitHub and Slack using Vercel Connect, Workflows, Sandbox, and AI Gateway.
- [How Vercel Sandbox duration and persistence work](/kb/guide/vercel-sandbox-duration-and-persistence): Session duration and persistence are two separate controls in Vercel Sandbox. The timeout option keeps a single run alive for up to 24 hours, while snapshots and persistent sandboxes carry state across runs for long-running agents and pipelines.