Agents And Tool Use medium
A data-analysis agent runs model-generated Python inside the same container as your API service. That container has database admin credentials in environment variables. A security review flags this as critical. What is the best mitigation?
- A Add a regex filter that blocks generated code containing os.environ, subprocess, or socket before it is executed in-process.
- B Execute generated code in an isolated sandbox with no production credentials, restricted network egress, and resource limits.
- C Ask the model to review its own generated code for dangerous operations before submitting it to the execution tool for real.
- D Run the code in-process but under a try/except wrapper with a timeout, so malicious or buggy code cannot crash the service.
Answer: B. Execute generated code in an isolated sandbox with no production credentials, restricted network egress, and resource limits.
**Sandboxing** removes the blast radius. Code that cannot see credentials or reach production networks cannot misuse them, regardless of what the model writes. A denylist filter (A) is tempting but easy to bypass with getattr, importlib, or encoded strings. The tradeoff is sandbox startup latency and the work of moving data into it. In-process execution is acceptable only for a tightly restricted expression language, not general Python.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You are defining a 'schedule_meeting' tool for an agent. Which schema decision most reduces wrong or malformed calls?
- A model emits three parallel tool calls: `get_inventory`, `get_price`, and `get_shipping`. To cut latency, the host appends each result to the transcript as it arrives and immediately re-invokes the model. Runs start failing with malformed-request errors, and some produce hallucinated shipping costs. What should the host do?
- A team splits a coding agent into planner, coder, tester, and reviewer agents, and each receives the full transcript of the previous agent. The expected quality gains did not appear. Cost tripled, and the reviewer often fixates on approaches that earlier agents abandoned. When is a multi-agent split actually justified?
- A support agent should remember each customer's preferences across months of sessions. The team appends every past session summary to the system prompt. After six months, prompts exceed 80,000 tokens, latency has doubled, and the agent sometimes ships to an address the customer replaced weeks ago. What redesign fixes both problems?
- A teammate proposes splitting a single coding agent into five agents, arguing that more agents means smarter results. When is a multi-agent split actually justified?
- An internal agent has grown to 120 tools, many with overlapping names like search_docs, find_docs, and query_docs. Wrong-tool errors are rising. What is the best next step?