DEV Community

Benni Alencar
Benni Alencar

Posted on Originally published at benni-os.net

Ephemeral AST Code Sandboxes for AI Agents: Zero Cold-Start Execution Without Cloud VM Latency

#python #security #ai #devops

When building coding agents (like Claude Code, Devin, or SWE-Bench benchmark agents), the agent must execute Python code, inspect test failures, and apply diffs in an isolated environment.

The traditional approach relies on Cloud MicroVMs (like Daytona or E2B). While secure, cloud sandboxes introduce severe operational friction:

  • Cold-Start Latency: 1.5s to 4s to provision a microVM per execution.
  • Cloud Costs: $0.05 to $0.15 per execution hour adds up quickly when running thousands of automated benchmark tests.
  • Context Window Blowout: Uncontrolled stdout/stderr dumps can flood your agent's context window with thousands of lines of terminal spam.

To eliminate these bottlenecks, we engineered agent-code-sandbox.

The Hybrid Architecture: Sub-Millisecond AST Guard + Ephemeral VFS

agent-code-sandbox provides safe, isolated execution directly on the host machine in sub-millisecond time (<0.2ms overhead):

  1. Pre-Execution AST Static Analyzer: Parses the Python Abstract Syntax Tree before execution. It detects and blocks dangerous calls (os.system, subprocess, __import__('socket'), reflective escapes like getattr(eval, '__call__')) before any bytecode executes.
  2. Ephemeral Virtual File System (VFS): Mounts a temporary scratchpad directory with atomic git diff tracking. Every file created or edited by the agent is tracked in an isolated working tree.
  3. Adaptive Token Shield: Limits stdout and stderr to a configurable token budget (e.g. 1,000 tokens), automatically truncating large stack traces and preventing agent context blowout.

Hands-on Implementation

Install via pip:

pip install agent-code-sandbox
Enter fullscreen mode Exit fullscreen mode

Execute code safely:

from agent_code_sandbox import CodeSandbox, SandboxConfig

sandbox = CodeSandbox(config=SandboxConfig(
    timeout_seconds=5.0,
    max_output_tokens=800,
    allow_network=False
))

# 1. Safe execution
code = """
import math
result = [math.factorial(i) for i in range(10)]
print('Calculated factorials:', result)
"""
exec_result = sandbox.execute_python(code)
print("Output:", exec_result.stdout)

# 2. Blocked malicious execution (<0.2ms rejection)
malicious_code = """
import os
os.remove('/etc/hosts')
"""
blocked_result = sandbox.execute_python(malicious_code)
print("Security Verdict:", blocked_result.security_rejection_reason)
# Output: Security Verdict: FORBIDDEN_IMPORT_DETECTED: os
Enter fullscreen mode Exit fullscreen mode

Native Model Context Protocol (MCP) Support

Expose code execution directly to your LLM tools:

python -m agent_code_sandbox.server
Enter fullscreen mode Exit fullscreen mode

Tools exposed: execute_python, execute_command, inspect_code_security.

Sovereign Ecosystem & Open Source

Top comments (1)

Collapse
 
alexshev profile image
Alex Shev •

Cold-start time is a real constraint, but AST-level isolation has to be explicit about what it does not isolate: imports, filesystem reachability, resource exhaustion, and side effects. A useful benchmark would publish those guardrails alongside latency, because speed without a containment model is not a sandbox.