Course Objective & Scope
Agents that analyse data, generate charts or run automation scripts execute untrusted, LLM-generated code at runtime. Running that code directly on the application host opens the door to remote code execution, data exfiltration and lateral movement across internal networks.
This course examines the limits of standard Docker hardening, gVisor user-space kernels, Firecracker microVMs (as used in E2B, Modal and Daytona architectures), WebAssembly/Pyodide options, egress network filtering and ephemeral credentials. Participants build an isolated code execution service and a security checklist tailored to enterprise policies.
Who Should Attend?
- AI engineers building coding, data analysis or automation agents
- Platform, DevOps and cloud engineers designing agent infrastructure
- DevSecOps and application security specialists securing AI workloads
- Prerequisite: Linux, container technologies and Python proficiency
Key Takeaways
- Analyse the threat model and sandbox escape vectors of LLM-generated code execution
- Select the right isolation tier among hardened containers, gVisor and microVMs
- Enforce strict CPU, memory, disk, execution timeout and network egress limits
- Exchange files and query data safely without exposing raw secrets inside the sandbox
- Manage warm pools and sandbox lifecycles for multi-tenant agent workloads
Curriculum
Threat Model for Code-Executing Agents
- Arbitrary code execution and data exfiltration triggered via prompt injection
- Why
eval(), AST filters and default Docker containers are insufficient
Isolation Technologies: Containers, gVisor, MicroVMs and Wasm
- Linux namespaces, cgroups, seccomp and the limits of rootless containers
- Kernel surface isolation with gVisor and Kata Containers
- Firecracker microVM architecture and WebAssembly/Pyodide alternatives
Resource, Filesystem and Network Controls
- Read-only root filesystems, ephemeral disk quotas and process limits
- Zero-trust networking: DNS/HTTP allowlists and blocking internal network access
- Secrets handling: proxy-injected authentication and short-lived tokens
Stateful Execution Sessions and Lifecycle Management
- Maintaining a stateful Jupyter kernel / REPL session and file I/O pipelines
- Reducing cold-start latency with warm pools and VM snapshots
- Audit logging, output size caps and deterministic teardown
Workshop: Building a Secure Code Interpreter Tool
- Wiring a data-analysis agent to an isolated sandbox service
- Red-teaming with escape, resource-exhaustion and exfiltration tests
Other Courses in This Category
-
Course on evaluating end-to-end task completion, trajectory quality and tool selection in AI agents, and setting up distributed tracing and live monitoring with OpenTelemetry, LangSmith, Arize Phoenix and Langfuse.
- Live Course
- 5 modules
-
Training on protecting multi-step agents against API outages, rate limits, partial failures and crashes using retries, model fallbacks, idempotency, compensating actions and durable execution with Temporal and LangGraph.
- Live Course
- 5 modules
-
Architectural design course examining prompt chaining, routing, parallelisation, orchestrator-workers, evaluator-optimizer and autonomous agent patterns, and how to pick the simplest effective pattern for each problem.
- Live Course
- 5 modules
-
Hands-on developer training on combining ReAct reasoning loops, Plan-and-Execute task planning and explicit state/checkpoint management into a single unified hybrid agent architecture.
- Live Course
- 5 modules
-
Technical course on delegating work across specialist agents using control handoffs versus the agent-as-tool pattern, covering triage routing, context filtering and conversation ownership.
- Live Course
- 5 modules
-
Course on designing reusable skill packages, progressive context disclosure, bundled scripts/references and dynamic capability loading so agents scale without overflowing their context window.
- Live Course
- 5 modules
Get in touch
