Running Agent-Written Code Behind a Sandbox: Timeouts, Limits and No Egress

1. The Problem: Generated Code Is Untrusted Input

A code-interpreter tool lets the model compute instead of guess: parse a CSV, draw a chart, run a unit test. The catch is that the code is written by a system that also reads untrusted text — web pages, issues, PDFs, output from other tools. Prompt injection turns ‘summarize this page’ into ‘run this snippet’, and you have remote code execution with one extra step.

The fix is not one product. It is a short stack: run the code somewhere disposable, give it a time budget and a resource budget, decide what the network can reach before it starts, and keep credentials out of the box. The providers below sell the disposable box; the rest is policy you write.

2. Minimum Concepts Before Touching Code

Six ideas cover almost everything. Keep them in mind and the provider snippets below read as variations on one theme.

3. Four Providers, Facts From Their Own Docs

I limited the table to what each provider states in its own documentation or pricing page as of 14 October 2026. Where a page gave no number, the cell says so instead of guessing. Prices and limits change, so treat this as a map to the pages in Sources, not as a quote.

4. Step 1 — The Tool Contract and Vercel Sandbox (TypeScript)

Start with the contract, because it is the same for every provider: the model sends code and a time budget; the tool returns stdout, stderr and an exit code, truncated; the host never executes anything itself. Below it runs on Vercel Sandbox (@vercel/sandbox 3.8.0 at publish time): create a sandbox with egress denied, write the file, run it with a per-command abort signal and always stop the VM.

TypeScript — runCode on Vercel Sandbox

import { Sandbox } from "@vercel/sandbox";

const MAX_OUT = 20_000; // characters handed back to the model

export async function runCode(code: string, budgetMs = 15_000) {
  const sandbox = await Sandbox.create({
    timeout: 60_000,           // hard session cap in ms (default 5 min)
    resources: { vcpus: 1 },   // default is 2
    networkPolicy: "deny-all", // blocks egress, DNS included
    persistent: false,         // one-shot: discard the filesystem on stop
  });
  try {
    await sandbox.writeFiles([
      { path: "agent-code.mjs", content: Buffer.from(code) },
    ]);
    const run = await sandbox.runCommand(
      "node",
      ["/vercel/sandbox/agent-code.mjs"],
      { signal: AbortSignal.timeout(budgetMs) }, // aborted call rejects
    );
    return {
      exitCode: run.exitCode,
      stdout: (await run.stdout()).slice(0, MAX_OUT),
      stderr: (await run.stderr()).slice(0, MAX_OUT),
    };
  } finally {
    await sandbox.stop(); // always, even when the call above throws
  }
}

With deny-all from the start there is no npm or pip install. If the task needs packages, use the live-update pattern from the docs: install with network in a trusted setup step, drop to deny-all, and only then run the untrusted code. For partial access the policy takes a domain list, and for credentials there is brokering: the firewall injects the header and the secret never enters the sandbox.

TypeScript — install, lock down, or broker a credential

// 1) Trusted setup with network, then lock before untrusted code
const sandbox = await Sandbox.create({ persistent: false }); // allow-all
await sandbox.runCommand("npm", ["install", "mathjs"]);
await sandbox.update({ networkPolicy: "deny-all" });

// 2) Or allow-list only what the task needs
const scoped = await Sandbox.create({
  networkPolicy: { allow: ["ai-gateway.vercel.sh"] },
});

// 3) Or let the firewall inject the credential (secret stays outside)
const brokered = await Sandbox.create({
  networkPolicy: {
    allow: {
      "ai-gateway.vercel.sh": [{
        transform: [{ headers: { Authorization: "Bearer " + process.env.AI_GATEWAY_TOKEN } }],
      }],
    },
  },
});

5. Step 2 — E2B Code Interpreter (TypeScript and Python)

E2B’s @e2b/code-interpreter gives you runCode with a Jupyter-style result, so the agent can send multi-line Python and read structured errors. Set the lifetime in the create call and mind the units: milliseconds in JavaScript (timeoutMs), seconds in Python (timeout). Switching internet off is a single flag, and network rules cover the allow-list case.

TypeScript — no internet, 60 s lifetime

import { Sandbox } from "@e2b/code-interpreter"; // needs E2B_API_KEY

const sbx = await Sandbox.create({
  timeoutMs: 60_000,          // JavaScript: milliseconds
  allowInternetAccess: false, // same as denyOut: ["0.0.0.0/0"]
});
try {
  const execution = await sbx.runCode(aiGeneratedCode);
  if (execution.error) {
    console.error(execution.error.name, execution.error.value);
    console.error(execution.error.traceback);
  } else {
    console.log(execution.logs);
  }
} finally {
  await sbx.kill();
}

In Python the same idea is spelled with snake_case, and the network option takes explicit allow and deny lists. Denying all traffic first and then allowing specific addresses is the shape the docs show.

Python — deny all, allow two ranges

from e2b_code_interpreter import Sandbox

sbx = Sandbox.create(
    timeout=60,  # Python: seconds
    network={
        "deny_out": lambda ctx: [ctx.all_traffic],
        "allow_out": ["1.1.1.1", "8.8.8.0/24"],
    },
)
try:
    execution = sbx.run_code(ai_generated_code)
    if execution.error:
        print(execution.error.traceback)
    else:
        print(execution.logs)
finally:
    sbx.kill()

6. Steps 3 and 4 — Modal and Daytona (Python)

Modal Sandboxes run commands in a container you define at runtime. You can pick the runtime — gVisor, or a VM with its own kernel — or leave it unset and Modal chooses. The default maximum lifetime is 5 minutes (configurable up to 24 hours), CPU and memory are explicit parameters, and the network is dropped with one flag.

Python — Modal Sandbox with block_network

import modal

app = modal.App.lookup("code-interpreter", create_if_missing=True)

sb = modal.Sandbox.create(
    image=modal.Image.debian_slim().pip_install("pandas"),
    app=app,
    timeout=120,         # seconds of max lifetime (default 300)
    cpu=1.0,             # fractional cores
    memory=1024,         # MiB
    block_network=True,  # drops all outbound traffic
)
try:
    p = sb.exec("python", "-c", ai_generated_code, timeout=15)
    print(p.stdout.read())
    print(p.stderr.read())
    print("exit code:", p.wait())
finally:
    sb.terminate()

Daytona (daytona and @daytona/sdk 0.224.1) creates a sandbox, runs code with process.code_run and takes a timeout in seconds. Documented defaults are 1 vCPU, 1 GB RAM, 3 GiB disk and auto-stop after 15 minutes of inactivity. Egress is set at creation with network_block_all, network_allow_list or domain_allow_list; they are mutually exclusive and a conflicting mix returns a 400.

Python — Daytona ephemeral sandbox, network blocked

from daytona import Daytona, DaytonaConfig, CreateSandboxFromSnapshotParams

daytona = Daytona(DaytonaConfig(api_key="YOUR_API_KEY"))  # read it from env

sandbox = daytona.create(
    CreateSandboxFromSnapshotParams(
        network_block_all=True,  # or domain_allow_list="example.com,*.daytona.io"
        ephemeral=True,          # deleted when stopped
        auto_stop_interval=5,    # minutes of inactivity (default 15)
    )
)
try:
    response = sandbox.process.code_run(ai_generated_code, timeout=10)
    if response.exit_code != 0:
        print("failed:", response.result)
    else:
        print(response.result)
finally:
    sandbox.delete()

7. A Lockdown Routine Around the Sandbox

The provider gives you the box. This is the routine I wrap around it so the box actually earns its keep:

8. Common Errors (and What Each Layer Does Not Cover)

The left column is what working integrations do; the right column is what shows up in incident reviews.

Conclusion

You now have the whole loop: a tool contract (code and budget in, stdout, stderr and exit code out), a disposable sandbox on E2B, Vercel Sandbox, Modal or Daytona, egress denied before the first line runs, two clocks, and output treated as untrusted. The providers differ in isolation technology, lifetime limits and pricing model, but the policy you write around them is the same.

This week, pick one provider, wrap it in the runCode contract above and add two CI tests: a canary egress attempt and an infinite loop. If both pass, ‘the agent can run code’ stops being a liability and becomes a feature with a measured blast radius. If your agent also installs skills or clones repos, read the related guides below: the sandbox is one layer, not the whole defence.

Sources

• Vercel — Understanding Sandboxes (isolation, lifecycle, security model)
• Vercel — Sandbox firewall (network policies, credentials brokering)
• Vercel — Sandbox pricing and quotas
• Vercel — Sandbox JS SDK reference
• E2B — Quickstart (code interpreter SDK)
• E2B — Internet access and network rules
• E2B — Sandbox lifecycle and timeouts
• E2B — Pricing
• Modal — Sandboxes guide
• Modal — Sandbox networking
• Modal — Security and shared responsibility
• Modal — Sandbox.create reference
• Daytona — Sandboxes
• Daytona — Network limits
• Daytona — Pricing