{"slug": "we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead", "title": "We stopped letting the AI write code. We let it write an AST instead.", "summary": "A developer detailed a security approach for AI-generated code that involves generating an executable AST instead of source code. The project, Hyperlambda, uses a whitelist of node types, making dangerous operations like shell commands impossible to express. The developer claims this eliminates common prompt-injection failure modes and offers a deterministic structural inspection before execution.", "body_md": "Every AI coding tool has the same security model, and the model is \"a human will read it.\"\n\nThe model writes source code. You skim it. You run it. Your only real defense is code review, and anyone who has reviewed generated code knows attention collapses somewhere around file four.\n\nThat works fine when the output is a React component. It works considerably less fine when the output is server-side code with database credentials in scope.\n\nWe took a different route, and I want to describe it because the idea generalizes beyond our product.\n\nHyperlambda is an executable AST. The model does not emit source code that we then parse and hope about. It emits nodes in a tree, and the runtime executes that tree directly.\n\nThe important property: only whitelisted node types exist.\n\nThere is no node that shells out. Not disabled, not sandboxed, not blocked by a policy layer that someone can misconfigure. The operation is absent from the language.\n\nSo the classic failure mode, where a model gets talked into generating something destructive, does not have a landing place. You cannot prompt-inject your way into rm -rf when the grammar has no concept of a shell.\n\nSandboxing is subtractive. You start with a general purpose runtime that can do everything, then you spend the rest of your life removing capabilities and patching the ones you missed. Every escape is a thing that was there by default and got overlooked.\n\nWhitelisting is additive. You start with nothing and add operations deliberately. An escape requires a bug in something we explicitly built, not something we forgot to remove.\n\nBoth approaches have failure modes. The difference is what a mistake costs you. Forgetting to remove a capability is a breach. Forgetting to add one is a support ticket.\n\nBecause the output is a tree rather than text, you can inspect it before execution. Not with a regex over source code, which is a losing game, but structurally.\n\nWhich nodes does this use. What does it touch. Does it read from a table it has no business reading from.\n\nThat check is deterministic and it runs in milliseconds. Try writing the equivalent for arbitrary generated Python.\n\nThe practical result is that you can describe an application in plain English and get a real backend without a review bottleneck. Database over SQLite, MySQL, PostgreSQL or SQL Server. Secured CRUD REST APIs. Auth including Google, GitHub, OAuth and OIDC. SPA hosting. Scheduled tasks.\n\nGenerated in minutes, and safe to execute because the language it generates into cannot express the dangerous things.\n\nArchitectural claims deserve testing rather than trust, so there is a standing bounty for escaping the sandbox. It has not been claimed.\n\nThe runtime is MIT licensed if you want to read it or run it yourself: [hyperlambda.dev](//hyperlambda.dev)\n\nHappy to argue about the tradeoffs in the comments. The obvious cost of this approach is expressiveness, and I do not think that objection is wrong.", "url": "https://wpnews.pro/news/we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead", "canonical_source": "https://dev.to/barnascript/we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead-1jn0", "published_at": "2026-09-02 10:38:30+00:00", "updated_at": "2026-09-02 10:53:00.790779+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "generative-ai"], "entities": ["Hyperlambda"], "alternates": {"html": "https://wpnews.pro/news/we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead", "markdown": "https://wpnews.pro/news/we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead.md", "text": "https://wpnews.pro/news/we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead.txt", "jsonld": "https://wpnews.pro/news/we-stopped-letting-the-ai-write-code-we-let-it-write-an-ast-instead.jsonld"}}