Limiting the Blast Radius of Arbitrary Code Execution

a digital illustration of a terminal. In the center of the terminal is an explosion but tthe blast is confined within a box

As more of us engage in workflows that involve large language models (LLMs) — by choice or by force — and as some of us (self-included) are exploring the space and educating ourselves so that we may exert control over the robots that seek to shape how we work, something we would all be better off for is controlling how exposed our file systems are to the whims of the bots. If you're sick of LLM talk, I've got good news. The software being featured today can limit the potential harm of more than just coding agents.

Normally virtualization or containerization is the recommended tool for this sort of thing, but if you generally trust the software you're running or just want an extra layer of safety, there is Jai, a lighter-weight alternative to VMs and containers that comes from the Stanford Secure Computer Systems research group and the Future of Digital Currency Initiative that does not require you to spend any time working with a virtual machine solution or writing Docker. The trade-off to this lighter-weight option is that there is less configuration and setup, but the protection is not as robust as a VM or a container, but it does serve to limit your file system's exposure to the errors of these confabulation machines.

This piece works through setting up Jai with the Crush harness.

Mac / Windows Users

Jai was targeted at Linux distributions. The following suggestions have not been tested by me, but they may be paths to explore. For Mac users, the maintainer of Jai highlights a few Mac options that were sent his way.

jaim, a fork of Jai that adds macOS support.
bx-mac, software sandboxing for Macs.
spawn, spinoff agents using the macOS native virtualization framework.

For Windows users, I performed a cursory search, and nothing immediately jumped out to me as a drop-in solution like Jai, but I would be tempted to try Jai + the Windows Subsystem for Linux (WSL) and see if that works.

What is a Jail

Jai uses the metaphor of a jail to describe how it is adding a layer of security to running these programs. In other parts of the documentation, Jai is referred to as a "casual sandbox." Effectively, a jail is an implementation of a sandbox. This one is less robust than other implementations of sandboxes, and while this might invite confusion, or there might be some hairsplitting difference, for this post, I'm going to stick with the sandbox metaphor.

Jai + Crush

Crush is the software we will be using to demonstrate Jai's sandboxing capabilities. Crush is an open-source LLM harness. If Crush is not your harness of choice, the Jai documentation provides examples of sandboxing other harnesses. Do note that the guide that follows can be used with any desired software.

Jai Installation

If you are on an Arch-based systemyay -S jai will install the latest version of this program.

The documentation demonstrates methods for installation on Debian and Ubuntu as well.

Initialization

To initialize the Jai config, run⁣ jai --init . This will set up your defaults, and you can view these with jai --print-defaults. To modify Jai's defaults, edit the $HOME/.jai/.defaults file.

Jai Modes

Before we get to sandboxing Crush, I want to highlight that Jai has different modes. There are three modes that Jai offers: casual, strict, and bare. By default (meaning you create an unnamed sandbox), the Jai command runs the casual mode. Casual is the default, and it provides a copy-on-write overlay of your real home directory. Strict requires slightly more initial setup but provides a deeper level of protection and really should be the default. The bare mode is the same as strict, but for when your home directory is on networked file storage. The documentation provides a helpful comparison table.

Sandboxing Crush

Navigate to your desired directory
Run jai crush

The first time I ran this, I ran it on a directory that had previously been set up with Crush. Jai doesn't mask the entire ~/.config directory by default. If you want to do that as an added measure of security, you can do that and then grant explicit access to the Crush config by running jai -d ~/.config/crush crush. If needed, you can pass -d flag multiple times.

I did this basic setup and then had Crush go on its merry way. It was able to call both an LLM on the LAN, an LLM outside my firewall, and an MCP server running on my machine. The addition of Jai to the process appears to have had no negative impact on the performance of the Crush harness.

Named Sandboxes

You can create named sandboxes with Jai. By default, named sandboxes are set to the strict mode. If you wanted to always run Crush in YOLO mode but wanted some protection, you could do: jai -j crush crush. Unlike the default casual mode, you may need to spend more time making sure Crush has access to everything because this runs Crush as an unprivileged Jai user with an empty home directory.

Other Cool Features

I did not exhaustively go over every feature that Jai has. The documentation is well put-together and not massive. It is worth reading in full and taking what will be best from your workflow. I also recommend reading the manual section and the docs. There's some overlap but also some spots where one fills in some details better than other spots.

One Off Scripts

You can use Jai for more than running LLM harnesses. You can also use it for running one-off scripts you pull from the internet or other commands where you trust it enough to run it but want a layer of protection.

Networked Home Directories

If your workflow has a networked home directory in the process, Jai can still aid you.

``. If your home directory is on a network file system, uncomment the storage line in $HOME/.jai/.defaults and point it to a directory you can write on a local file system.

Defending Your Home Directory

If you run from jai from you home directory, you will be met with the following message:

jai: Refusing to grant your entire home directory to jailed code. Run "jai -D" to avoid granting the current working directory.

This is a welcome and sensible standard.

Coda

I have fallen victim to the whims of a tool at work and wish I had incorporated something like this back then. There was a command on an internal tool that "reset" our Git workspace by effectively deleting and recloning everything one level up. The documentation of that tool did not call that out in the command. I lost about a day reconfiguring all of my locally cloned repositories for development. Had I run that tool inside Jai, it would have saved me all that time I lost resetting my development environment.

If the pedal is to the metal on agentic LLMs, a proper VM or container solution is the best bet, but for the barest protection, Jai is a neat tool that can enable more secure computing beyond the domain of LLM tools.

If you like this piece, consider supporting the work at Screaming at the Silicon. The main in-progress series is We Have the Torment Nexus at Home, where I go through setting up and using local language models with free software, but there is other computer and programming work entirely unrelated to tech de jour already available and in the pipeline.

Bibliography

“Containerization (Computing).” Wikipedia, 5 May 2026. Wikipedia, https://en.wikipedia.org/w/index.php?title=Containerization_(computing)&oldid=1352599589.

Install / Build | Jai - Easy Containment for AI Agents. https://jai.scs.stanford.edu/install.html. Accessed 18 May 2026.

“Sandbox (Computer Security).” Wikipedia, 17 May 2026. Wikipedia, https://en.wikipedia.org/w/index.php?title=Sandbox_(computer_security)&oldid=1354681720.

“Virtualization.” Wikipedia, 17 Apr. 2026. Wikipedia, https://en.wikipedia.org/w/index.php?title=Virtualization&oldid=1349497564.

License

The accompanying image Terminal Containment © 2026 by Glass Hound Computing, LLC is licensed under CC BY-SA 4.0. To view a copy of this license, visit https://creativecommons.org/licenses/by-nc-sa/4.0/