execute_python: How AI Generates and Executes Code in an Isolated Sandbox for Security

Introduction

Imagine asking an AI to write code for data analysis, and it doesn't just output text—it immediately runs it, showing you the result. This isn't magic, but a complex mechanism based on the execute_python function. However, with the ability to execute code come risks: malicious scripts, data leaks, and infinite loops. How does AI handle this? The answer is a sandbox—an isolated environment where code runs safely. In this article, we'll break down how execute_python works, the technologies behind it, and why it's crucial for security.

What is execute_python?

Execute_python is a function or API that allows an AI model (e.g., GPT or Claude) to generate Python code and immediately execute it on the server side. Instead of just showing the code to the user, the AI runs it in real-time, returning output (stdout/stderr) or errors. This turns a chatbot into an interactive tool for programming, data analysis, and automation.

How does it work?

1. Code generation: The AI receives a request (e.g., "Plot a sales graph") and writes a Python script.
2. Syntax check: Before execution, the code is checked for syntax errors (via ast.parse or compile()).
3. Isolation: The code is sent to a sandbox—a container or virtual machine.
4. Execution: The sandbox runs the code with restrictions (CPU, RAM, time limits, network access).
5. Return result: Output (text, numbers, images) is sent back to the chat.

Why is the sandbox critical?

Without isolation, executing AI-generated code would be dangerous. Imagine the model accidentally (or maliciously) generates a script:

import os
os.system('rm -rf /')

The sandbox prevents such threats by limiting:
- File system access: only a temporary directory.
- Network requests: blocking external connections.
- System calls: prohibiting dangerous operations (fork, exec).
- Resources: time limit (usually 30–60 seconds) and memory (e.g., 256 MB).

Types of sandboxes

• Docker containers: Lightweight, each request creates a new container.
• Pyodide in WebAssembly: Code execution in the browser, fully isolated.
• Restrictive interpreters: e.g., pypy with modified builtins.
• Virtual machines: Full isolation, but slower.

Example: How execute_python is used in practice

Suppose a user writes: "Find the median of numbers [1, 5, 3, 9, 2]." The AI generates:

import statistics
data = [1, 5, 3, 9, 2]
print(statistics.median(data))

The sandbox executes the code, returns 3. If the code contains an infinite loop:

while True:
    pass

The sandbox interrupts execution after 5 seconds and returns a TimeoutError.

Technical implementation details

Step 1: Code generation

The AI uses templates and context to create safe code. The model may be trained to avoid dangerous calls (e.g., eval(), exec() with unchecked data).

Step 2: Static analyzer check

Before execution, the code passes through flake8 or bandit to identify vulnerabilities. Example checks:
- Ban on import os or import subprocess.
- Blocking __import__('os').system('ls').

Step 3: Running in an isolated environment

Technologies used:
- gVisor: Lightweight kernel emulating system calls.
- Firecracker: MicroVM from AWS, starts in milliseconds.
- nsjail: Utility for isolating processes in Linux.

Step 4: Handling results

Output is captured via subprocess.PIPE or sockets. If the code generates an image (matplotlib), it is base64-encoded and inserted into the response.

Security: Main risks and their prevention