When you give a language model the ability to call tools — run code, query databases, browse the web — you've created an autonomous execution surface. Most tutorials skip the part where that surface gets exploited.
This post covers practical steps for sandboxing LLM tool calls before they reach production. No theory: concrete code patterns that limit the blast radius when something goes wrong.
Why Tool Calls Are a Different Threat Surface
A standard LLM integration is relatively contained: input goes in, text comes out. The worst case is a model generating harmful content.
Agent architectures change the calculus entirely. The loop looks like this:
