Why your AI agents need a sandbox (and what Cloudflare just shipped)

An AI agent generates a function that your application wants to execute immediately. The code may be wrong or request access it should not have. It needs an isolated environment with explicit permissions. Cloudflare Dynamic Worker Loader provides one execution option within Workers.

The container problem

A container can provide the required environment and libraries. For short, frequent tasks, measure startup cost and resource use against an isolate-based option before choosing.

The important boundary is between the application and untrusted generated code. Grant only the capabilities the task needs.

What Cloudflare shipped

Cloudflare introduced the open beta as a way to instantiate a Worker with code supplied at runtime. An isolate provides a separate execution context, with capabilities controlled by the application.

Cloudflare reports faster startup and lower memory use than a typical container. These are provider claims, rather than a measured result for your workload.

Measure the complete path, including model and external API calls. A nearby isolate does not mean the whole request has zero latency.

Here's the flow. Your main Worker receives a request, an AI model generates a TypeScript function, the Worker calls the Dynamic Worker Loader, which creates a V8 isolate, loads the code, executes it, returns the result. After the response, the isolate is discarded. For a one-off task, the isolate can then be discarded. Access depends on its configuration and exposed interfaces.

Code Mode

There's a pattern Cloudflare calls Code Mode that I find genuinely interesting. The standard tool-calling protocol goes model generates JSON, runtime executes, model analyzes result, calls next tool. Code Mode has the agent write one TypeScript function that chains the entire workflow instead.

Cloudflare reports token savings for a particular Code Mode demonstration. That result is not a guarantee for an invoice workflow.

Say the agent gets "create an invoice in Stripe for customer X with items Y." Instead of four separate tool calls it writes one function that does the entire flow in a single pass.

The constraints

Cloudflare recommends JavaScript for small generated snippets and notes that Workers can also use Python and WebAssembly. Check library support, execution limits and service access before choosing. Verify current Dynamic Workers documentation and pricing rather than relying on beta terms.

My take

If you're building agents that generate and execute code, isolation isn't optional. Dynamic Workers are one good answer. Fast, cheap, and they scale. But not the only answer. Sometimes you still need a container. Sometimes a constrained API workflow avoids executing generated code at all. It depends on what the agent does and what data it touches.

The harder question is how you design the boundary between trusted and untrusted code in an agent system. Cloudflare doesn't answer that one, and shouldn't. The sandbox is just the execution layer. What goes inside it, what it's allowed to call, and who checks the output before anyone sees it. That's the architecture problem. If you're working through it, we've written about agent vs. automation decisions and multi-model strategies that touch on this.

If you're building an agent that runs user-generated code and want to talk architecture, get in touch.