Words
Running code is an effect.
The operating system manages files, programs, and devices. A process is a running program. A child process is a program that another process starts. Limits have to follow the child: a shell, an installer, a browser.
An interpreter runs instructions written in a programming language. A build prepares software to run, and a build can execute scripts from a repository. An environment variable is a named setting a process can read. If it holds a credential, untrusted code in that process can often read it.
A sandbox restricts the environment where code runs. The restriction has to come from the operating system or the infrastructure, not from a sentence in the prompt. A container isolates part of an application while sharing the host’s kernel, the core of the operating system. A virtual machine runs a separate operating system and is a stronger split for untrusted code.
A mount makes a folder from the host visible inside the container. That can undo the isolation. A socket is a channel between programs. An administrative socket is powerful. Do not expose one because setup was easier that way.
A shell command, a package install, a build hook, and a notebook cell can read secrets and open network connections. Include interpreters, editor extensions, MCP startup, browser processes, and background jobs. Not only the command the model typed in the chat.