# How to Add Secure Code Interpreting in Your AI App Vasek Mlejnsky, E2B.dev | AI Engineer World's Fair 2024 | 1:48:16 Source: https://www.youtube.com/watch?v=k0VIgKAUkP4 Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks. Page: https://aietalks.com/talks/how-to-add-secure-code-interpreting-in-your-ai-app Published: 2025-02-06 Tags: computer-use, multimodal, security, tool-use ## TL;DR - An AI app can let an LLM generate Python and run it through a tool call inside an isolated E2B sandbox. - A per-user sandbox preserves variables and files between code snippets, while a new sandbox is created when no matching session exists. - Execution results include standard output, errors, runtime traces, and rich results such as PNG images, HTML, PDFs, and JSON for rendering in the frontend. ## Summary Vasek Mlejnsky builds an open-source version of Anthropic's Artifacts interface with Next.js, Vercel's AI SDK, Anthropic Sonnet 3.5, and E2B's Code Interpreter SDK. The app sends chat messages to the model, exposes a run-python tool, executes the generated code in a Firecracker-based virtual machine, and displays the result beside the chat. The workshop covers the backend endpoint, tool schema, sandbox creation and reconnection, result handling, frontend streaming, and chart rendering. A sandbox is associated with a user ID so later snippets can reuse the same notebook context. Mlejnsky also explains how E2B uses Linux virtual machines for isolation, how Dockerfiles customize the VM filesystem, and how cloud storage can be mounted. He is honest about the unfinished parts, including interactive charts, GPU sandboxes, and some self-hosting ergonomics. ## Key ideas ### The workshop builds a Python version of the Artifacts interaction [00:00](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=0s) Mlejnsky starts with the interface he wants to reproduce: chat on the left and a preview on the right. The model writes code, and the application renders and runs it beside the conversation. His version supports AI-generated Python in addition to HTML, JavaScript, and CSS. Sonnet 3.5 generates the code through function calling, while E2B runs it in a secure sandbox. The sandbox can run what a Linux machine can run, and applications can create many sandboxes for code interpretation. ### The application combines the Vercel AI SDK with E2B Code Interpreter [13:36](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=816s) The prepared Next.js project uses two main pieces. Vercel's AI SDK connects the application to models and streams responses between the backend and frontend. E2B's open-source Code Interpreter SDK creates a predefined environment inside a sandbox, which Mlejnsky describes as a small virtual machine. A Jupyter server runs inside the sandbox and accepts Python, JavaScript, R, and beta Java execution. It returns standard output, error output, charts, and other rich results. The SDK wraps E2B's more general sandbox API. ### Tool calling gives the model a controlled way to request execution [26:24](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=1584s) The workshop adds a run-python tool to the model call. Its schema describes a code string, along with a title and longer description for the interface. The tool definition tells the model what it can call, and its asynchronous execute function receives the generated parameters. Mlejnsky notes that applications could add tools for JavaScript, shell commands, or file creation. Some users instead ask models to emit Markdown and parse it themselves because they prefer to avoid the streaming complexity around tool calls. ### A user-linked sandbox preserves context across snippets [38:03](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=2283s) Creating a new sandbox for every request would discard earlier variables and files. To preserve context, the application lists running sandboxes and searches their metadata for the current user ID. If it finds a match, it reconnects using that sandbox's ID. If it finds nothing, it creates a sandbox and stores the user ID in its metadata. Mlejnsky describes a separate sandbox for each user session as a common application pattern. The same notebook context can then be reused when later generated code refers to previous work. ### Jupyter execution returns more than a string [45:08](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=2708s) The run-python function obtains a sandbox and calls the notebook execution method with the generated code. The returned execution object includes logs, error output, structured runtime errors, and cell results. Cell results can contain charts, PNG and JPEG files, PDFs, HTML, JSON, or text. Runtime errors include a traceback that an application can send back to the model so it can correct its code. In the demo, printing 'hello world' appears in standard output, while a Monte Carlo visualization arrives as a base64 PNG with a text description. ### The frontend can stream tool status alongside model messages [1:01:58](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=3718s) The application passes a user ID from the frontend into the chat request, then returns the tool result from execute. Mlejnsky adds the AI SDK's stream data helper to send arbitrary status data with the model response. The backend emits a running status when run-python starts and a complete status when it finishes. The frontend receives this data from useChat and passes it to the side-view component. This lets the interface show that execution is in progress instead of waiting silently for the next assistant message. ### The preview renders sandbox output from cell results [1:14:42](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=4482s) The final frontend step enables the artifact view inside the side view. The component reads the execution result, extracts cell results and logs, and checks for a PNG result. It then renders the base64 image with Next.js's Image component. The demo displays a chart generated inside the sandbox next to the conversation. Mlejnsky says the same result structure can support HTML or table previews, depending on what the generated code and libraries return. Interactive charts would require operating on the underlying data and rendering it with a frontend chart library. ### Firecracker virtual machines provide the isolation boundary [1:31:03](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=5463s) E2B runs each sandbox as a Linux virtual machine using AWS's open-source Firecracker technology, rather than as a container. Mlejnsky says the VM restarts when code attempts to get outside it, and the Jailer restricts certain system calls. Linux and KVM virtualization add more overhead than containers, but each user session gets a separate VM that cannot see other sandboxes. He gives startup times of about 900 milliseconds for the current system and says the target is about 400 milliseconds. Sandboxes are destroyed when they close unless data is saved to connected cloud storage. ### Custom Dockerfiles define the VM environment [1:33:47](https://www.youtube.com/watch?v=k0VIgKAUkP4&t=5627s) Developers can customize a sandbox with a Dockerfile based on Ubuntu. The file can install packages, add environment variables, and include application files such as a scaffolded Next.js project. E2B starts the Docker image as a container, extracts its filesystem, and converts that filesystem into a Firecracker VM root filesystem. The resulting sandbox can use private packages or images because the Dockerfile is built with the developer's Docker instance. Mlejnsky also mentions planned AWS support, broader Linux-machine support, observability, and VM snapshots, while saying GPU sandboxes are not currently offered. ## Notable quotes - "The easiest out of the box is create a tool called something like run python in our case for this specific use case and then inside the tool we will actually implement the secure code execution inside the sandbox." (26:24) - "The reason we are using Jupiter server there is because that's what we noticed has been one of the most frequent use case from our users and our customers." (15:35) - "The answer is no, so at the moment when you start a sandbox and you kill the sandbox at some point or it just closes by itself, everything is destroyed." (1:22:55) - "The short answer is security." (1:34:44) ## Tools & references mentioned - Anthropic - Anthropic Sonnet 3.5 - Claude Artifacts - E2B.dev - E2B Code Interpreter SDK - Vercel AI SDK - Next.js - Firecracker - AWS - KVM - Jupyter - Docker - Google Cloud Storage - Amazon S3 - Cloudflare R2 - Zod - Plotly.js - Chart.js - Devin ## Who should watch - You are adding an AI data analyst, dashboard, generative UI, or coding agent and need a concrete pattern for executing model-written code. - Your Next.js application already streams model responses, but you need tool calls, persistent execution context, and rich results such as charts. - You are weighing containers against virtual machines for untrusted code and want to hear how E2B handles isolation, customization, storage, and future snapshots. ## Related talks - [Why, and how you need to sandbox AI-Generated Code?](https://aietalks.com/talks/why-and-how-you-need-to-sandbox-ai-generated-code) (Harshil Agrawal, Cloudflare, 38:27) - [Securing Code-Executing AI Agents](https://aietalks.com/talks/securing-code-executing-ai-agents) (Fouad Matin, OpenAI, 14:00) - [Beyond the Prototype: Using AI to Write High-Quality Code](https://aietalks.com/talks/beyond-the-prototype-using-ai-to-write-high-quality-code) (Josh Albrecht, Imbue, 17:59) - [Code Mode: Let the Code do the Talking](https://aietalks.com/talks/code-mode-let-the-code-do-the-talking) (Sunil Pai, Cloudflare, 19:40) - [Arrakis: How to Build an AI Sandbox from Scratch](https://aietalks.com/talks/arrakis-how-to-build-an-ai-sandbox-from-scratch) (Abhishek Bhardwaj, OpenAI, 40:18)