Cloudflare Sandbox AI code execution can let an assistant transform files or run calculations without placing generated code directly inside the main application. The critical decision is what the execution environment can reach. Code can use the files, credentials, network routes and tools you make available to it.
Run generated code inside an execution boundary chosen for the workload, with deliberately limited inputs, network access and application capabilities. Keep consequential operations outside that environment and validate returned artifacts before use. Test containment, resource handling and cleanup with hostile as well as ordinary code before expanding access.
Imagine an analyst asking an assistant to combine permitted CSV exports and produce a chart. The assistant needs those input files and a place to write an output. It does not need the company’s entire storage account or a credential that can modify the source system.
This article describes a proposed architecture for that task. It does not claim that isolation removes every risk or that the same sandbox environment is suitable for every language and dependency.
Define the Cloudflare Sandbox AI code execution boundary
Cloudflare’s Sandboxes overview distinguishes container-based environments from Dynamic Workers. The appropriate environment depends on the execution requirements. Choose from the current documentation rather than assuming an older Sandbox SDK example describes today’s interface.
For the analyst’s transformation, list the required language, libraries, input formats, output types and network destinations. If the task only needs local computation over supplied files, additional external access needs a separate reason.
Keep the orchestration Worker responsible for deciding which job belongs to which authenticated user. The code-running environment should receive only the task’s permitted material, not an account-wide set of credentials from which it can discover more.
| Capability | Needed for the example? | Boundary to define |
|---|---|---|
| Read selected input exports | Yes | Only the authorized job inputs |
| Write result files | Yes | A dedicated output location |
| Access the public Internet | Not inherently | Named destinations only if justified |
| Read production credentials | No | Keep service authority outside the job |
| Modify source business records | No | A separate reviewed application operation |
Choose the environment from execution needs
Cloudflare’s environment selection guide is the starting point for comparing the available approaches. Confirm the actual supported language, dependency and lifetime requirements for your task.
A full command environment can be useful where a toolchain genuinely needs it. It also introduces files, processes and dependency behaviour to account for. A narrower execution surface may be easier to review when the task only needs a bounded transformation.
Avoid choosing the most powerful environment simply because it makes the first demo easier. The procurement question is whether the environment can perform the permitted task with controls your team can explain and maintain.
Pin the execution image or dependency configuration where the selected platform supports that approach. Record the configuration with the result so a later failure can be related to the environment that actually ran the code.
Keep secrets and business authority in the application
Cloudflare’s credentials and network guidance explains the relevant control surface. Establish how the chosen environment reaches approved services, and verify that behaviour directly in your test configuration.
For the analyst job, the orchestration application can obtain authorized exports and deliver them as inputs. The generated program then operates on those copies. If it needs another data source, return a request to the application, where identity and permission checks still apply.
Do not hand over a broad storage credential and rely on the prompt to say which folder is allowed. The authority is the credential and execution boundary, not the politeness of the model’s instruction.
Use the same principle for outputs. The job can propose a file or result. A separate application component decides whether to publish, email or import it. This keeps generated code from turning a transformation request into an unreviewed business action.
Treat files as untrusted inputs and outputs
Validate input type and size before execution under an agreed policy. Preserve an input manifest so the team can establish exactly which files entered the job. Avoid mixing inputs from different users in a shared workspace without a verified isolation design.
Output files also need inspection. A file with the expected extension can contain an unexpected format, hidden content or a misleading calculation. Confirm the artifact type, permitted location and semantic checks before presenting it as a completed result.
For a financial chart, compare totals with the source data and explain any exclusions. A cleanly rendered image does not prove the underlying calculation is correct. For an archive or document export, inspect what files and data it actually contains.
| Artifact stage | Suggested check | What it prevents |
|---|---|---|
| Input admission | Authorized source and expected format | Accidental cross-user data processing |
| Workspace preparation | Task-specific paths and bounded contents | Reuse of another job’s material |
| Output collection | Expected type, path and size policy | Unexpected files presented as deliverables |
| Semantic validation | Totals, references or task-specific assertions | Plausible but incorrect results |
| Publication | Explicit application authority | Generated code distributing data on its own |
Test hostile code within the permitted test environment
The acceptance set should include attempts to read outside the supplied workspace, contact an unapproved destination and consume excessive resources. Use synthetic data and a dedicated test environment so the test itself cannot expose production material.
Test the controls you actually configured. A diagram showing no Internet connection is not evidence that outbound access is blocked. Capture the result of attempted access and the reason the environment returned.
Cloudflare’s sandbox security guidance is the primary reference for the environment’s boundaries. Application controls still need their own tests, including authentication, job routing and output publication.
Also test ordinary failures: a dependency import error, an invalid CSV, a process that never finishes and an output larger than the application’s policy. An operator needs a clear failure category and a safe way to end or inspect the job.
Make lifetime and cleanup observable
Define when a job begins, which events end it and what survives afterward. Distinguish the execution environment from retained result artifacts and operational evidence. Ending a process does not necessarily remove files copied into another storage service.
If workspaces are restored or reused, establish which task data can return. A convenient persisted workspace can become a cross-task data problem if routing or cleanup assumptions are wrong.
Keep a record of job ownership, source manifest, execution configuration, completion reason and collected outputs. Retain only the content required by the task and its agreed review policy.
Rehearse cancellation and cleanup after a failed job. Confirm that the next task cannot inspect the previous task’s inputs, and that the application can still explain the failure without keeping an unnecessary copy of every file.
Estimate a controlled execution service
The development cost includes orchestration, identity, input preparation, execution controls, artifact validation and operations. It is larger than the code needed to run a command once.
Ask for a GBP proposal that defines supported task types and languages. A bounded CSV transformation service is a clearer first scope than a general assistant allowed to run arbitrary programs across company systems.
Recurring costs depend on the chosen environment, runtime, storage, model use and failure handling. Verify the current platform rates for that environment. Do not import a container estimate into a Dynamic Workers design or assume that idle, failed and restored work are free.
The pilot should produce useful artifacts and prove the boundary around them. Demonstrate a valid job, a blocked capability, cancellation, cleanup and a rejected output. These results let the owner decide whether another task type can be added safely.
We can scope that service through our AI integration pilot . Request a sandbox execution proposal with input examples, required tools and the actions the assistant must never perform without separate authority.
Frequently Asked Questions
Does a sandbox make AI-generated code safe automatically? No. Isolation is a useful boundary, but the code can use the capabilities and data supplied to its environment. Define and test files, credentials, network access, resource policy and output handling.
Should generated code receive production API keys? Avoid giving it broad service authority. Keep credentials in the application layer where access can be checked, and expose only the bounded operations the task needs. Verify the chosen platform’s supported credential and network controls.
Do all tasks need a Linux container? No. Choose the environment from the language, dependencies and execution requirements. Cloudflare documents different approaches, and a narrower surface may be sufficient for a bounded task.
Can the assistant publish its generated files automatically? Only under a separately agreed application policy. Creating an artifact and distributing it are different actions. Validate the output and check publication authority before importing, emailing or exposing it.
What should a containment test include? Use a dedicated environment and synthetic data to test unauthorized file access, unapproved network destinations, excessive resource use, cancellation and workspace cleanup. Retain evidence of the configured controls rather than relying on the architecture drawing.
Can we reuse workspaces between tasks? Only with a deliberate isolation and retention design. Reuse can preserve useful context, but it can also retain another task’s data. Test routing, restored contents and cleanup before depending on it.
What determines implementation cost? Supported languages, dependency needs, input preparation, capability controls, artifact validation and support requirements drive the work. Start with a bounded task and request a GBP proposal that includes failure tests and operational handover.