Node.js security: vm and worker_threads fail to safely isolate AI-generated code

Node.js backends increasingly need to execute AI-generated code, but running untrusted scripts poses serious security risks. The built-in vm module allows code execution in a synthetic context but cannot prevent sandbox escape attacks. Worker threads move execution off the main event loop but still share access to Node's internal APIs like filesystem and network. True isolation requires V8 Isolates, which create separate V8 engine instances with their own heap and memory limits. Libraries like isolated-vm implement this approach to safely run untrusted code within defined resource constraints.