Part 1 of 4 · 1 min read
Overview
A code-execution or file tool turns a prompt injection (module 1) into arbitrary effects on a host. Interviewers ask "how would you safely let an agent run code?" The strong answer names the layers and what each does not cover.
About the example, and what is real
Real: the confinement, URL and command checks, the resource-limited subprocess runner and its probes (they actually ran on this Linux machine), and the 40 test cases in code/mini-sandbox. Assumed: the attack lists (10 paths, 10 URLs, 9 commands) are my own hand-written examples, and the allowlist host names are fictional .test names. Not real: no container or VM boundary, no network namespace or proxy, no seccomp; the command check only inspects strings and never runs the commands. Limits behave as shown on this kernel; other systems differ (for example macOS and Windows).