Treat agent-written code as hostile and keep secrets outside the sandbox

A speaker on the Cloudflare Developers show argued that code written by an AI agent should be treated as untrusted. The safe design keeps secret keys outside the box where that code runs. A checkpoint adds a key only to outgoing requests it has approved. The episode is "Securely Run LLM Generated Code in Cloudflare Sandboxes", published on 4 November 2026.

What was said

The speaker's example was an agent that updates the npm packages in a GitHub repository, tests the result and opens a pull request. Npm is a common library store for JavaScript. The agent writes scripts to do this and runs them in a sandbox, an isolated container. The speaker said: "Whatever the example is inherently, you cannot trust that LLM generated code."

The danger they named was theft. The code, they said, may take secret credentials and send them to its own domain. So the first step is to turn off internet access. Then the team allows only what the job needs: github.com, npm and api.github.com.

A function in the Cloudflare Worker, the small server program that controls the sandbox, intercepts every outgoing request. It can approve or deny each one. It can insist on HTTPS. It can also swap the allowed list between a setup phase and a code-running phase.

The same checkpoint handles secrets. If a request is a pull request to GitHub, it attaches the key in a header. The code can do its job, but as the speaker put it, "it doesn't directly ever have access to environment variables." Those variables live at the Worker level, not in the container.

Why it matters

Our reading: this moves the safety question away from whether the agent behaves. It asks where the keys are kept. If the code never holds a key, a hijacked or careless agent has nothing to send out.

For anyone buying or running agent tools, that gives three plain questions. Where do the keys live? Is outgoing traffic blocked by default? Who owns the list of allowed domains? The speaker also noted that this resembles how Claude managed agents and Cursor cloud agents can run some tool work inside a company's own environment.

The other side

This is a Cloudflare channel walking through a Cloudflare product, so it is a how-to, not an independent test. The speaker did not claim that a leak is impossible. The claim was narrower: the generated code never directly holds the environment variables.

The excerpts also leave open what happens when an approved request is itself abused. The checkpoint attaches the key to a legitimate pull request, and the speaker did not say how the content of that request is checked. The allowed list is also only as good as the people who write it. The talk shows the mechanism, not how teams should choose the rules.