Problem 1 of 15 in the Harnessing Agentic AI Systems series — read the index for the framing. Next: Static Intercepting Gatekeeper Pattern.
The Problem — Containing untrusted execution
An agentic system executes code that is untrusted by construction — written by a model, possibly steered by injected instructions. A mistake or an attack must die with the task that produced it.
| Field | P1 — Ephemeral Sandbox Wrapper (pattern) | A1 — The Naked Prompt (anti-pattern) |
|---|---|---|
| Forces / Smell | Isolation wants a real boundary; performance wants none. Ephemerality vs persistence; teardown completeness vs free cleanup. | API keys in the prompt or environment; the model told to "be careful"; no proxy layer between the model and the credentials. |
| Solution / Anti-solution | Spawn isolated, short-lived virtual environments (e.g., Docker, WASM) per task; mutate freely; destroy on completion. | Treat the model as an application boundary and the prompt as an access control list. |
| Consequences / Failure | Blast radius bounded by lifetime, not trust; clean training trajectories; the wrapper reifies the outside world, making recovery promises possible. | Injection converts instructions into actions; credentials exfiltrate (OWASP LLM01, LLM02, LLM07 in 2025; LLM06 in 2023/24). |
| Tradeoffs / Refactoring | Startup latency and state loss; heavy isolation vs WASM limits; only as good as its teardown — teardown must be derived from the load, not remembered. | P1, P2, and a transparent secrets proxy so the agent never sees the credentials — the Replit pattern; the xz lesson: the tool that runs arbitrary code with your credentials is the highest-value target in your supply chain. |
| Evidence | LangChain sandbox integrations (docs); Replit's thirteen-layer stack (Sandboxes Are Hard); DeepSeek file-effects-only sandbox vocabulary (DeepSeek teardown). | OWASP Top 10 (2025); Willison's prompt injection series (series). |
| Related | Composes with P2; cousin of the sandbox-stack pattern; refactoring for A1. | Leads to A3; fixed by P1 and P2. |
Discussion
The pattern converts trust into lifetime: the system does not need to believe the code is safe, it needs the code to die with the task — which is why teardown must be derived from the load, not remembered. The anti-pattern is containment skipped: it trusts the least trustworthy component with the most valuable secrets, because instructions are data. Where the guarantee stops: the wrapper bounds the process, not the world — which is why the gatekeeper (P2) must sit outside it.
Key Insight
Trust is a lifetime property, not a belief. The wrapper converts "is this code safe?" into "does this code die with the task?" — and a guarantee you must remember to enforce is a guarantee an agent will, at some point, not.
References
LangChain sandbox integrations (docs); OWASP Top 10 for LLM Applications (2025); Willison's prompt injection series (series); archive: Sandboxes Are Hard, DeepSeek teardown, spatiotemporal composability.