LLM Inference Interview Questions #13 - The AST Sandbox Trap

Why relying on code denylists to secure your LLM agents silently exposes your entire application, and the kernel-level isolation you actually need to stop a breach.

You’re in a Staff AI Engineer interview at Google and the interviewer asks:

“You shipped a code-executing agent behind an AST sandbox that blocks os, subprocess, and dunder access. Security signed off. Six weeks later you’re breached. What class of attack did your sandbox structurally fail to stop?”

Don’t say: “The model found a bypass, we need a stricter denylist.”

Wrong instinct. You’re describing a bug. The interviewer is asking about an architecture flaw.

The reality: an AST denylist is a linter cosplaying as a firewall.

You blocked names. Attackers use capabilities. Three ways that gap gets exploited:

• Capability reachability through allowlisted deps. You blocked os. You allowed pandas and numpy. Both are full-capability C extensions that already imported everything you banned. read_pickle() and np.load(allow_pickle=True) are arbitrary code execution with a friendly docstring. The agent never types a forbidden token.

• Static analysis vs. a dynamic language. The AST sees code before it exists. Attribute names built at runtime, getattr chains, exception tracebacks walking back to frame globals, codecs, aliased imports, Python hands you a dozen ways to construct a reference the parser never saw. You are enumerating badness, and badness is infinite.

• Same process = no boundary. This is the one candidates miss. Even a perfect filter runs inside your address space. One bypass isn’t “the sandbox leaked”, it’s your API keys, your DB session, your service credentials. Your blast radius is the entire application.

And the exploit that usually lands? It never breaks a rule. Untrusted content from a fetched page tells the agent to POST your context to an attacker’s endpoint using the HTTP client you approved. That’s a confused deputy, 100% permitted operations, 100% breach.

---

The answer that gets you hired:

You don’t sandbox code, you sandbox processes. Isolation is a kernel property, separate process, gVisor/microVM or container, no ambient credentials, and an egress allowlist, because untrusted input plus network access is exfiltration regardless of what the interpreter permits. The AST filter is defense-in-depth, never the boundary.

---

#AIEngineering #LLMOps #AIAgents #MachineLearning #AISecurity #MLEngineering #SystemDesign

---