Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · AI Workload Sandboxing & Validation
Run models in a sandbox
Verify that AI models execute in isolated sandboxes.
OWASP AISVS v1.01, requirement 4.1.1
In plain English
Run models in an isolated environment that has only the access serving needs. Model servers parse complex files and handle hostile input all day. If one is compromised, the sandbox decides whether the attacker gets one container or your whole cloud account.
What good looks like
- Model servers run in containers or virtual machines, as a non-root user, with a read-only file system apart from named scratch space.
- Network access is denied by default. Outbound connections go only to the services the model server needs.
- The process holds no credentials beyond those needed to serve. In particular it has no broad cloud role.
- Models from outside sources get stronger isolation than models you built.
How teams usually do it
- Hardened containers: dropped Linux capabilities, a seccomp profile, no privilege escalation, and Kubernetes network policies that block egress by default.
- A sandboxed runtime such as gVisor or Kata Containers, or a microVM such as Firecracker, for third-party or untrusted models.
- A narrowly scoped workload identity for the serving pods, separate from the identity used to deploy them.
Suggested evidence
- Container security settings and network policy configuration.
- The permissions attached to the serving identity.
- A test showing the model server cannot reach the internet or the cloud metadata service.
Common mistakes
- Running the model server with broad cloud credentials attached.
- Leaving egress open, so a compromised server can send weights or data anywhere.
- Running containers as root with the GPU device mounted and no other restrictions.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.