LLM Inference Interview Questions, issue 13, Aug 11, 2026
The AST Sandbox Trap
Staff AI Engineer interview at Google, and the interviewer asks:
“You shipped a code-executing agent behind an AST sandbox that blocks os, subprocess, and dunder access. Security signed off. Six weeks later you’re breached. What class of attack did your sandbox structurally fail to stop?”
Don’t say: “The model found a bypass, we need a stricter denylist.”
Why relying on code denylists to secure your LLM agents silently exposes your entire application, and the kernel-level isolation you actually need to stop a breach.
The full answer, with the mechanism and the arithmetic, is for paid subscribers on Substack.