Python sandboxes, like RestrictedPython, operate on AST level. But don't try to sandbox the code, create isolated UNIX processes or containers instead.