AI生成コードをCloud Runサンドボックスで安全に実行 Safely run AI-generated code in Cloud Run sandboxes

Google Cloud has moved a sandboxing capability for Cloud Run into public preview, giving developers a managed way to run AI-generated code inside isolated environments. The feature addresses a fast-growing problem: as large language models increasingly write and execute code on the fly, teams need somewhere safe to run output they cannot fully trust.

The underlying concern is that code produced by an LLM is effectively untrusted input. Whether it is generated to analyze a file, call an external API, or carry out a multi-step task, model output can contain bugs, consume excessive resources, or, in adversarial cases, attempt to read secrets or reach systems it should not. Running that code directly on an application server or a developer's machine exposes those environments to real risk. A sandbox contains each execution so that a crash, an infinite loop, or a malicious action stays confined to a disposable environment rather than spreading to production infrastructure.

Cloud Run is Google's serverless platform for running containers without managing the underlying servers, and it has long relied on gVisor, an open-source application kernel that intercepts and mediates system calls to isolate workloads from the host. That isolation heritage makes it a natural place to layer a dedicated sandbox product. Based on the announcement, the new capability appears to let applications spin up isolated, ephemeral compute environments programmatically, execute code within them, capture the results, and tear them down—an interaction pattern well suited to autonomous agents that generate and run many short-lived snippets.

For developers building agent applications, this fills a specific architectural gap. A typical "code interpreter" style workflow has a model reason about a task, emit code, run it, observe the output, and iterate. Doing this safely at scale requires per-request isolation, fast startup so latency stays low, resource limits to prevent runaway usage, and clean teardown to avoid state leaking between sessions or users. Offering these primitives as a managed service means teams no longer have to assemble their own container orchestration, harden it against escape attempts, and operate it themselves.

The move places Google alongside a cluster of companies competing to supply infrastructure for AI-driven code execution. Startups such as E2B and Modal have built businesses around on-demand sandboxes for LLM agents, and Daytona and others target similar workloads. The broader pattern echoes existing consumer features like OpenAI's code interpreter and Anthropic's code execution tools, which run model-written code in constrained environments behind the scenes. At the infrastructure layer, AWS Lambda uses the Firecracker microVM technology to isolate functions, illustrating how serverless providers have converged on lightweight virtualization as a foundation for multi-tenant, untrusted execution.

The timing aligns with Google's wider push around agents. The company has been expanding tooling across Vertex AI, the Gemini model family, its Agent Development Kit, and the Agent2Agent protocol aimed at interoperability between systems. Safe code execution is a prerequisite for many of those agentic use cases, because an agent that can only produce text is far more limited than one that can act on the world by running code, querying data, or invoking tools. Positioning the sandbox on Cloud Run also lets it inherit the platform's autoscaling, pay-for-use billing, and integration with the rest of Google Cloud.

Several caveats are worth keeping in mind. Public preview generally signals that a feature is functional but not yet covered by the same service-level and stability commitments as general availability, and details such as pricing, quotas, regional availability, and supported languages or runtimes may change before launch. Sandboxing also reduces but does not eliminate risk: teams still need to think about data exfiltration through permitted network paths, prompt injection that steers an agent toward harmful actions, and the credentials or scopes granted to sandboxed code. Isolation is one layer of a defense-in-depth strategy rather than a complete solution.

For organizations already evaluating agent frameworks, the practical takeaway is that a major cloud provider is now offering managed execution isolation as a building block rather than a do-it-yourself project. Whether it becomes a default choice will likely depend on how its latency, cost, and language support compare with specialized competitors, and on how quickly it graduates from preview to a production-ready service with firm guarantees.