Prompt Injection Sandboxing

Expert

Isolate untrusted LLM outputs from downstream code execution boundaries.

01 The Concept

When LLMs write code, database queries, or trigger APIs, there is a risk of prompt injection executing malicious commands.

Sandboxing isolates execution environments using secure microVMs (like AWS Firecracker or WASM) and enforces strict input/output schemas to prevent data leaks or host system compromise.

02 Weak vs. Strong

EX 01Code Execution Sandbox Pipeline

LLM generates code

code_payload = llm_response.code

Run inside isolated WASM container

with WASMSandbox(network=False, read_only=True) as box: try: output = box.execute(code_payload, timeout_ms=500) except Exception as e: output = "Security Refusal"

Safely return console output

→ Why it works

Blocks malicious system access. Even if the LLM is jailbroken to run system commands, the sandbox lacks permission to access host resources or networks.

03 Key Points

01Untrusted Outputs: Always treating LLM generations as unsafe, untrusted user inputs.

02Isolation Boundaries: Running code generated by models inside ephemeral, network-disabled microVMs.

03Least Privilege Access: Restricting database API keys to SELECT-only query constraints.

04Output Sanitization: Checking generated commands against syntax parsers and AST checkers.

05Blast Radius Control: Enforcing memory, disk, and CPU runtime limits on executions.

04 Model-Specific Notes

Claude supports secure code execution sandboxes in commercial interfaces (e.g. Artifacts), separating code display from execution.

05 For Your Role

It's like putting a suspicious package inside a sealed glass box with robotic gloves to inspect it, so it can't explode in the room.

Next: Constitutional Safety Alignment →