Running the code an LLM wrote

The problem

What we built

• Ten questions over ten scattered files (CSV, Parquet, JSONL), with the correct answers computed separately.
• The same model and the same schema for three variants: the model writes Synsema (run with run_program and a permission ceiling), pandas (run with exec, and again inside Docker) or DuckDB SQL.
• Four escape tests against every executor: read .env, reach the network, overwrite the data, run forever.

Results

The code, side by side

def run_py_in_process(code):
    """What most products do: exec in the same process. No limits."""
    out = io.StringIO()
    t0 = time.perf_counter()
    try:
        with contextlib.redirect_stdout(out):
            exec(code, {"__name__": "__main__"})
        return True, out.getvalue(), round((time.perf_counter() - t0) * 1000)
    except Exception as e:
        return False, f"{type(e).__name__}: {e}\n{out.getvalue()}", round((time.perf_counter() - t0) * 1000)

let CEILING be "stdout,file.read=./cases/02-llm-written-analytics/data/*"

-- Fixed preamble: the generated code may ask for more, the ceiling trims it anyway
let PREAMBLE be "require file.read(\"./cases/02-llm-written-analytics/data/*\")\n"

        let run be run_program(PREAMBLE + code, {"ceiling": CEILING, "profile": "native", "timeout": 20})

Why Synsema

• run_program starts a child process of the same binary under a ceiling that is the intersection with the parent's permissions. The child can never exceed it.
• The generated code even asked for the network and for .env with require. The ceiling trimmed them: declared but above the host ceiling.
• No container, no image, no daemon. A sandboxed answer costs about as much as an unsandboxed one.

What it does not solve

• Models know Synsema less than Python or SQL: 1 extra attempt across 10 questions and higher LLM latency, because the language guide travels with every request.
• Restricted DuckDB is a good choice when SQL is enough, but allowed_directories also allows writing, and it does not stop endless queries by itself.
• SQL covers aggregations well. For multi-step logic, Python or Synsema read more naturally.

Share