Keep secrets outside the sandbox where AI-written code runs

A speaker on Cloudflare Developers argued that code written by an AI model should never be trusted with your secrets. In the episode "Securely Run LLM Generated Code in Cloudflare Sandboxes", published on 4 November 2026, the platform does the guarding. It controls where the code can send data, and it holds the credentials itself.

What was said

The demo has an agent write code snippets, run them in an isolated container called a sandbox, and finally open a pull request, which is a proposed change, on GitHub. The agent may run several versions of its code before it gets the result it wants.

The speaker said the code cannot be trusted, because a model wrote it. Their example of the risk: "it may take secret credentials and send them to its own domain, for example."

So the setup starts with all internet access turned off. It then allows only what the job needs: github.com, npm (a store of code packages) and api.github.com. A function in the Cloudflare Worker, the platform's small program layer, inspects every outbound request. It rejects any domain that is not on the list and checks that the connection is secure. The speaker added that the approved list can change by phase, one for setup and another for running code.

Credentials follow the same route. When the handler sees a request to create a pull request, it adds the secret key to that request. The speaker said the agent's code can do its job, but "it doesn't directly ever have access to environment variables." Those variables live at the Worker level, outside the container.

Why it matters

Our reading: this moves the protection from the model's behaviour to the platform's rules. If a key sits where generated code runs, the owner of that key pays when the code goes wrong. If the key stays outside, a faulty or hostile script can still make the allowed request. It cannot copy the key.

For anyone buying or building agent tools, two questions follow. Where do the credentials live while the agent's code runs? Which domains can that code reach? The talk shows one concrete answer to each.

The other side

This was a walkthrough of Cloudflare's own product, so it shows how the tools work, not how well they hold up. The speaker did not discuss attacks, failures or cost.

The design also leaves questions open. The agent's code can still ask for approved actions, such as creating a pull request, and the talk did not say how to judge whether such a request is legitimate. Someone still has to choose the domain list for each phase. The talk did not cover what happens if that list is wrong. The speakers were not named in the source, so we cannot say who they are.