Sandboxing AI Agents with Dynamic Worker Loader

Cloudflare has introduced Dynamic Worker Loader, a lightweight sandboxing mechanism that enables developers to execute AI-generated code securely and efficiently. This feature is designed to support consumer-scale agents, where every end user has an agent (or many!) and every agent writes code. Dynamic Worker Loader is now in open beta, available to all paid Workers users.

Key Technical Details

Dynamic Worker Loader uses isolates, instances of the V8 JavaScript execution engine, to sandbox code execution. Isolates are around 100x faster and 10x-100x more memory efficient than typical containers. This allows developers to start a new isolate for every user request, on-demand, to run one snippet of code, and then throw it away. The Dynamic Worker Loader API allows a Cloudflare Worker to instantiate a new Worker, in its own sandbox, with code specified at runtime.

Practical Implications for Developers

With Dynamic Worker Loader, developers can:

• Execute AI-generated code securely and efficiently
• Scale to millions of requests per second without limits on global concurrent sandboxes and rate of sandbox creation
• Use the same underlying sandboxing mechanism that the entire Cloudflare Workers platform has been built on since its launch
• Take advantage of unlimited scalability and on-demand execution of code snippets

Example Code

The example code provided demonstrates how to use Dynamic Worker Loader to load a worker to run AI-generated code. The code specifies the code to be executed, gives the agent access to the chat room API, and blocks internet access.

// Have your LLM generate code like this.
let agentCode: string = ` export default { async myAgent(param, env, ctx) { // ... } } `;

// Get RPC stubs representing APIs the agent should be able // to access.
let chatRoomRpcStub = ...;

// Load a worker to run the code, using the worker loader // binding.
let worker = env.LOADER.load({
  // Specify the code.
  compatibilityDate: "2026-03-01",
  mainModule: "agent.js",
  modules: { "agent.js": agentCode },
  // Give agent access to the chat room API.
  env: { CHAT_ROOM: chatRoomRpcStub },
  // Block internet access. (You can also intercept it.)
  globalOutbound: null,
});

// Call RPC methods exported by the agent code.
await worker.getEntrypoint().myAgent(param);