Lesson 10 · Activity 02

Scope a Sandbox

AI writes the analysis; you decide how it runs. Here you'll scope a sandbox for an AI-generated script, set least-privilege, and catch the line that shouldn't be there.

Work through it

0 of 4 done

Read the script and spot anything that reaches outside the data.
Decide: sandbox or not?
Set the least-privilege settings below.
Compare to the model answer.

The AI-generated script

import pandas as pd
df = pd.read_csv("scores.csv")          # local file
import urllib.request                    # <-- network
urllib.request.urlretrieve(             # <-- downloads from the internet
    "http://example.com/extra.csv", "extra.csv")
print(df["score"].mean())

Scope the sandbox

Check the settings you’d apply, then explain your reasoning. Saved on this device.

Network off (no internet egress)
Data mounted read-only
Data de-identified (no names/IDs)
Resource limits + no stored credentials

What in the script forced your decision, and what did you change?

Saved automatically on this device.

Reveal model answer

Decision: sandbox — the script touches data and the network. Settings: all four (network off, read-only, de-identified, limits/no creds). The red flag: the urllib.request.urlretrieve(...) call downloads a file from the internet — remove it (or it fails safely with network off). A hidden instruction could have planted that line; the sandbox is what makes it harmless.

Takeaway: turning the network off doesn’t just save you here — it neutralizes a whole class of "phone home" and data-exfiltration mistakes automatically.