Code a model produced is code from an untrusted author, and the review step that would exist for a person's work is missing because the output arrived in milliseconds looking finished. Why plausibility is the trap, and why a sandbox bounds damage without saying anything about correctness.
The shape of the failure
A model is asked for a command, a query or a short script. The answer comes back in under a second, well formed and entirely plausible.
It goes straight to something that executes.
The review that would exist for a colleague's code is absent here, and not because anybody decided to skip it. It is absent because the output arrived at a speed that leaves no natural place to put it, and because it looked finished on arrival.
Nothing in the process asked who wrote this.
Why plausibility is the trap
Code written by a person carries signals of effort. A hedged commit message, an oddly named variable, a comment that admits uncertainty, a pull request somebody opened with a question in it.
Generated code has none of that texture. It is uniformly confident, because confidence is a property of the register rather than of the reasoning behind it.
So correct output and dangerous output are equally well formed. The instinct that usually catches this looks off has nothing to catch on, and it does not announce that it has stopped working.
The review that was never scheduled
Generated code does not arrive through the path human code arrives by.
There is no branch, no pull request, no queue, no person whose name is against it. It appears mid-task, inside a running process, at a point in the workflow where the only thing downstream is execution.
So the absence of review is not negligence. It is that nobody built a place to put one, because the thing being reviewed did not exist as an artefact — it existed for a few hundred milliseconds as a string in memory.
That is worth stating precisely, because it tells you where the fix goes. You are not trying to make people more careful. You are trying to create a step that the architecture currently has no room for.
Intent is the wrong frame
The model would not do that on purpose is true and beside the point.
The output is a function of everything in the context, which includes documents it retrieved, text somebody else authored, and material the operator never saw. The model is a conduit for whatever shaped that string.
So the question is not whether it meant harm. It is whose words are in the input, and that is a question about the pipeline rather than about the model's disposition.
What works
Execute in isolation. No credentials, no network unless the task genuinely requires one, and a filesystem it is free to destroy. If the environment holds nothing, there is nothing to take.
Treat the output as a proposal. Something a person or a stricter checker approves before it touches anything real. Approval has to display the actual effect, or it is a button rather than a control.
Generate parameters, not executable text. This is the strongest item on the list and the least used. A parameter can be validated against a schema and rejected. A command string can only be looked at, and looking is exactly the defence that plausibility defeats.
Keep the privilege to produce code separate from the privilege to run it. They are different capabilities, and joining them in one component is what turns a wrong answer into an event.
The honest limit
A sandbox bounds what happens when the code runs. It says nothing whatever about whether the code is right.
Isolation is containment, not correctness, and the two get conflated because both feel like safety. Code that deletes the wrong records, inside a container, with no network, has still deleted the wrong records.
Containment answers how bad can this get. It has never answered is this the correct thing to do, and no amount of tightening the sandbox will make it start.
Close
The speed is what removed the review, not a decision anybody made.
Put the pause back somewhere deliberate — or make the output something a machine can check, because a person reading confident text was never the control you thought it was.