Why it matters
NVIDIA's AI Red Team describes a prompt-injection chain that bypassed sanitization in a natural-language analytics workflow and turned generated Python into remote code execution (CVE-2024-12366). By abusing trusted namespaces, encoding, and runtime behavior, the case shows why static filters and LLM-based code checks cannot make arbitrary generated code safe; the structural control is per-user, segmented sandboxing.
My takeaway: Treat all model-generated code as attacker-controlled. Run it in ephemeral, least-privileged environments with no ambient credentials, narrow network and filesystem access, isolate users and sessions, monitor execution, and retain sanitization only as defense in depth.