Let a coding agent run its own code in a disposable sandbox

A coding agent’s day goes like this: read the task, write a script, and immediately want to run it.

The script was just generated by a model and you have not read every line. It might read a directory it should not, install a dependency you have never heard of, or simply loop forever. Run it on your own machine and you are the one cleaning up.

This post uses one small case to show how to hand the “run” step to a disposable sandbox: destroy it when done and nothing is left behind.

The scenario

You ask the agent to analyze a sales file: total the amount per region, highest first. The agent writes a Python script. What we do:

Create a sandbox.
Put the data file in it.
Run the agent’s script inside the sandbox.
Get the result back.
Destroy the sandbox.

Nothing the agent wrote needs to be installed on your machine, and the script never touches your files.

Setup

The default provider is Alibaba Cloud Agent Sandbox Express Edition (alicloud-express), which needs an API key.

curl -fsSL https://raw.githubusercontent.com/Alibaba-Agent-Sandbox/agent-sandbox/main/install.sh | sh
export ABX_SANDBOX_API_KEY="<YOUR_API_KEY>"

Windows users can install the binary with irm https://raw.githubusercontent.com/Alibaba-Agent-Sandbox/agent-sandbox/main/install.ps1 | iex in PowerShell. Follow the installer’s PATH instructions; on Windows, open a new terminal. Run abx --version before continuing.

In PowerShell, configure the key with abx config set sandbox_api_key <YOUR_API_KEY> instead of the Bash export command above.

The Python client distribution is agent-sandbox-client; its import remains agent_sandbox. Until the matching client and server packages are available on PyPI, install both from the same pinned source revision:

python -m pip install "agent-sandbox-server @ https://github.com/Alibaba-Agent-Sandbox/python-sdk/archive/35da216a300f1e2e84254a1cf4b4a7ea98681505.tar.gz#subdirectory=server-sdk" "agent-sandbox-client @ https://github.com/Alibaba-Agent-Sandbox/python-sdk/archive/35da216a300f1e2e84254a1cf4b4a7ea98681505.tar.gz#subdirectory=client-sdk"

With the Python SDK

Here is the whole script. AGENT_CODE is the part the agent generated; we hand it to the sandbox as is.

import asyncio
from agent_sandbox import Sandbox

CSV = """region,amount
hangzhou,120
beijing,80
hangzhou,45
shanghai,200
beijing,30
"""

AGENT_CODE = '''
import csv

totals = {}
with open("/home/user/sales.csv", newline="") as f:
    for row in csv.DictReader(f):
        totals[row["region"]] = totals.get(row["region"], 0) + int(row["amount"])

for region, amount in sorted(totals.items(), key=lambda kv: -kv[1]):
    print(f"{region:<8}{amount:>6}")
'''


async def main():
    async with await Sandbox.create(template="base") as sandbox:
        await sandbox.files.write("/home/user/sales.csv", CSV)
        result = await sandbox.run_code(AGENT_CODE)
        print(result.text)
        print("exit code:", result.exit_code)


asyncio.run(main())

A few things to notice:

async with destroys the sandbox on exit, whether the script succeeded or raised.
run_code runs code in the sandbox’s interpreter. For a shell command use sandbox.commands.run(...).
Check result.exit_code and result.stderr, and hand the error back to the agent so it can fix its own script. That is a complete write, run, fix loop.

The script prints:

shanghai   200
hangzhou   165
beijing    110

With the CLI

The same flow by hand with abx:

abx create --template base
abx upload <sandbox-id> ./sales.csv /home/user/sales.csv
abx upload <sandbox-id> ./analyze.py /home/user/analyze.py
abx exec <sandbox-id> -- python /home/user/analyze.py
abx kill <sandbox-id> --yes

analyze.py is the script inside AGENT_CODE above, and <sandbox-id> is the value abx create prints. The result prints in your terminal; use abx download when you need a file back. Always abx kill when you are done: a sandbox uses quota for as long as it lives, and abx list shows everything still running.

Let the agent call it itself

If you would rather skip the glue code, let the agent in your IDE use the sandbox over MCP:

abx mcp install --target cursor   # or claude, vscode

From then on creating a sandbox, moving files, running code and destroying it are tool calls.

What you get

Isolation: the agent’s code runs in a remote, disposable environment and neither reads nor changes your local files.
Disposability: the sandbox is destroyed afterwards, so wrong dependencies and temp files do not linger.
Repeatability: every run starts from the same template, so the same input gets the same environment.

It is not magic. Code in the sandbox can still use whatever you give it: the files you upload and the environment variables you inject. Do not put secrets in a sandbox that does not need them.

Where to go next

Need dependencies preinstalled? Write a template or find one in the Registry.
Want another backend? See the providers, install one first, then pass it to Sandbox.create(provider=...).
The full steps are in Get started.