Sandboxing AI-generated code: why we moved from WASM to AWS Lambda