How to safely run AI generated code in your application

AI models are increasingly used to generate code. Often, applications return this code to the user as plain text. But some apps could run the generated code to produce UI or other results.

This creates powerful possibilities but introduces risk. Generated code is untrusted. It may delete files, leak sensitive data, or consume excessive resources. The danger increases when users can influence prompts and craft malicious input. Running such code on your machine or in your production application is unsafe.

Vercel Sandbox addresses this by running untrusted code in a remote, isolated environment with strong safeguards and full control.

In this guide, you'll learn:

• What Vercel Sandbox is and how it works.
• How to create a sandbox, run commands, and capture results.
• Example: Use the AI SDK Agent to generate and safely execute code inside a sandbox.

Vercel Sandbox is an ephemeral compute primitive designed for untrusted workloads.

• Isolated: Each sandbox is a Firecracker microVM with its own filesystem, process, and networking. Code inside cannot access other sandboxes or the host application that initiated it.
• Ephemeral: Sandboxes are created on demand. They run until the configured timeout (max 45 minutes) or until explicitly stopped.
• Configurable: You can specify runtime (node22, python3.13), vCPUs, ports, and timeouts. You run shell commands, write and read files, and use a number of pre-installed packages such as git.
• Observable: Logs, stdout, stderr, and exit codes are streamed back. You can view sandboxes in the Vercel dashboard under Observability > Sandboxes.
• Cost model: You pay primarily for active CPU and provisioned memory. Idle waiting (e.g., API calls) does not count as active CPU.
• Extensively tested: Sandbox uses the same underlying technology that powers Vercel builds and v0.

To understand how Vercel Sandbox works, let's build a minimal AI app that responds to natural language queries that require computation or network access, such as:

• "Get the top story from Hacker News"
• "What is 44 × 44?"

To keep the example simple and avoid boilerplate code, we'll use the following tools:

• A Next.js route handler that accepts user input and returns the result.
• The AI Gateway to query OpenAI without managing API keys.
• The AI SDK to create an agent that orchestrates tool calls and sandbox execution.
• Vercel Sandbox to run the generated code.

Here's how it works:

Since the generated code and packages are unpredictable and potentially unsafe, we will run and install them inside Vercel Sandbox.

Create a minimal Next.js project:

1
pnpx create-next-app sandbox-example --api

Install required packages:

1
pnpm add @vercel/sandbox ai zod

• Prerequisite: Install the Vercel CLI.

Vercel Sandbox and AI Gateway use Vercel OIDC tokens to authenticate whenever available. This is the most straightforward and recommended way to authenticate. You can also authenticate using access tokens.

Link local directory to Vercel project:

1
vercel link

Pull OIDC token for local development:

1
vercel env pull 

In development, the token expires after 12 hours (run vercel env pull again to refresh). In production, Vercel manages token expiration for you.

Finally, we'll set up a Next.js route handler that accepts a request, generates and runs code and returns a response to the user.

1
import { NextRequest, after } from "next/server"
2
import { Sandbox } from "@vercel/sandbox"
3
import { Experimental_Agent as Agent, stepCountIs, tool } from "ai"
4
import { z } from "zod"
5

6
export async function POST(req: NextRequest) {
7
  let sandbox: Sandbox | null = null
8

9
  const body = await req.json()
10
  const parsed = z
11
    .object({ prompt: z.string().min(1).max(10_000) })
12
    .safeParse(body)
13
  if (!parsed.success) {
14
    return Response.json(
15
      { error: "Invalid body. Expected { prompt: string }." },
16
      { status: 400 },
17
    )
18
  }
19
  const { prompt } = parsed.data
20

21
  // create an isolated VM
22
  sandbox = await Sandbox.create({
23
    runtime: "node22",
24
    // stop sandbox after 30 seconds of inactivity
25
    timeout: 30_000,
26
  })
27
  console.log(`[agent] sandbox ${sandbox.sandboxId} created`)
28

29
  const agent = new Agent({
30
    model: "openai/gpt-5-nano",
31
    system:
32
      "You are an AI assistant that generates and runs JS. Use console.log to output values.",
33
    tools: {
34
      generateAndRunCode: tool({
35
        description: "Use this tool to run JS code in Node.js v22 sandbox",
36
        inputSchema: z.object({
37
          code: z.string().describe("The JS code to run"),
38
          packages: z
39
            .array(z.string())
40
            .nullable()
41
            .default([])
42
            .describe("Optional packages to install"),
43
        }),
44
        execute: async ({ code, packages }) => {
45
          // If the LLM output provides packages, install them with npm.
46
          if (packages && packages.length > 0) {
47
            console.log(`[agent] npm install ${packages.join(" ")}`)
48
            const installStep = await sandbox.runCommand({
49
              cmd: "npm",
50
              args: ["install", ...packages],
51
            })
52
            const installOut = await installStep.stdout()
53
            console.log(`[agent] npm install exit=${installStep.exitCode}`)
54
            if (installStep.exitCode !== 0) {
55
              return { output: installOut, exitCode: installStep.exitCode }
56
            }
57
          }
58
          console.log(`[agent] generated code:\n${code}`)
59
          console.log(`[agent] node -e (code length=${code.length})`)
60
          // Execute generated code, e.g. node -e "console.log('Hello, world!')"
61
          const runResult = await sandbox.runCommand({
62
            cmd: "node",
63
            args: ["-e", code],
64
          })
65
          const output = await runResult.stdout()
66
          console.log(`[agent] node exit=${runResult.exitCode}`)
67
          return { output, exitCode: runResult.exitCode }
68
        },
69
      }),
70
    },
71
    stopWhen: stepCountIs(10),
72
  })
73

74
  console.log(`[agent] generate start`)
75
  const result = await agent.generate({ prompt })
76
  console.log(`[agent] generate done (text=${result.text.length} chars)`)
77

78
  after(async () => {
79
    // cleanup sandbox after request is done
80
    await sandbox.stop()
81
  })
82
  return Response.json({ text: result.text })
83
}

We can now test our application using a prompt. Start the Next.js development server by running pnpm run dev, then in a new terminal window, send a user query using cURL:

1
curl -X POST \
2
  -H "Content-Type: application/json" \
3
  -d '{"prompt":"Get Hacker News top story title and URL"}' \
4
  http://localhost:3000/api/agent | jq .

You can switch to the development server terminal to observe the program running. Finally, once done, you can switch back to the other terminal to see the result. You should see a message that includes the title and url of a hackernews post.

You can also see the benefit of running the generated code in a sandbox by intentionally sending destructive and malicious queries to your application.

Attempt to delete files:

1
curl -X POST \
2
  -H "Content-Type: application/json" \
3
  -d '{"prompt":"Delete the ./tmp folder and show me the result"}' \
4
  http://localhost:3000/api/agent | jq .

Expectation: The folder (if it exists) is removed inside the sandbox, but your main application files are unchanged.

Attempt to read secrets:

1
curl -X POST \
2
  -H "Content-Type: application/json" \
3
  -d '{"prompt":"Print process.env"}' \
4
  http://localhost:3000/api/agent | jq .

Expectation: You only see environment variables of the sandbox and not the host environment.

This example showed how to combine Next.js, the AI SDK, and Vercel Sandbox to safely run generated code. Learn more in the Vercel Sandbox docs and API reference, and try it out in your own project today.