Why does AI generated code need isolation?
A traditional container runs application code you wrote and reviewed, with a predictable set of operations. Code an LLM produces is different in kind: it attempts anything, correct or not, including destructive commands and unexpected network calls. A sandbox answers that with short-lived environments, default-deny networking, CPU and memory limits, and secrets kept out of reach. Every line the model writes should be treated as untrusted input rather than application code, and the boundary designed accordingly; this is the execution-side partner to guardrails around tool calling more broadly.
What about the code interpreter?
A code interpreter is the narrow ancestor of the general sandbox: the agent runs Python to analyze data or produce an exactly computed answer, which also cuts hallucination on anything arithmetic, since a computed result beats a guessed one every time. Modern sandboxes generalize the idea. Agents install dependencies, build artifacts, execute their own tests, and iterate over multiple turns inside one persistent environment. The isolation requirements stay identical while the workload grows far broader than one script per question.
Where the task is operating a full desktop instead of writing code, that is computer use, a separate risk surface with its own containment story.