Why it matters
NVIDIA uses a PandasAI code-execution vulnerability to explain why generated-code sanitizers are brittle: namespace access, encoding, imports, and runtime context can turn apparently allowed syntax into arbitrary execution. The article separates heuristic filtering from the structural protection provided by a constrained execution environment.
My takeaway: Treat generated code as untrusted and execute it in an ephemeral, per-user sandbox with no sensitive mounts, minimal credentials, resource limits, and denied-by-default egress. Keep static or LLM-based sanitization as defense in depth, then destroy the environment and retain an auditable record of code and side effects.