diff --git a/docs/code-execution-security-guide.md b/docs/code-execution-security-guide.md
index d20ec97..8c4f831 100644
--- a/docs/code-execution-security-guide.md
+++ b/docs/code-execution-security-guide.md
@@ -174,6 +174,10 @@ Validation is basic pattern matching. Not comprehensive - relies on sandbox for
 
 ## Configuration
 
+### Sandbox Selection
+
+By default (when the `sandbox` argument is not specified), `execute_code` uses the restricted `anvilmcp` sandbox configuration. If this fails (e.g., due to kernel or permission constraints), it falls back to the `default` sandbox — the same configuration used by the outer landrun invocation. This compromise provides "just works" behavior and avoids surprises, while still applying the tighter sandbox when possible.
+
 ### Adjusting Timeout
 
 Default: 30 seconds
diff --git a/docs/code-execution-security.md b/docs/code-execution-security.md
index 25b80aa..b4edf00 100644
--- a/docs/code-execution-security.md
+++ b/docs/code-execution-security.md
@@ -314,6 +314,10 @@ import { evil } from "/etc/passwd";
 
 ## Subprocess Configuration
 
+### Sandbox Selection
+
+By default (when the `sandbox` argument is not specified), `execute_code` uses the restricted `anvilmcp` sandbox configuration. If this fails (e.g., due to kernel or permission constraints), it falls back to the `default` sandbox — the same configuration used by the outer landrun invocation. This compromise provides "just works" behavior and avoids surprises, while still applying the tighter sandbox when possible.
+
 ### bash Permissions
 
 ```bash