Can I load a Java class in a way that automatically removes its privileges?

I am working on developing a library that needs to instantiate and return untrusted objects downloaded from an external website. At a high-level, the library works as follows:

• Clients of the library requests a class from a remote source.
• My library instantiates that object, then returns it to the user.

This is a major security risk, since the untrusted code can do just about anything. To address this, my library has the following design:

• I enable the SecurityManager and, when instantiating the untrusted object, I use an AccessController to handle the instantiation in a context where there are no privileges.
• Before returning the object back to the client, I wrap the object in a decorator that uses an AccessController to forward all method requests to the underlying object in a way that ensures that the untrusted code is never run with any permissions.

It occurs to me, though, that this might not be the most elegant solution. Fundamentally, I want to strip away all permissions from any object of any type downloaded from the remote source. My current use of AccessController is simply a way of faking this up by intercepting all requests and dropping privileges before executing them. The AccessController approach also has its own issues:

• If the wrapped object has any methods that return objects, those returned objects have to themselves be wrapped.
• The wrapper code will potentially be thousands of lines long, since every exported method has to be secured.
• All of the methods exported by the downloaded object have to be known in advance in order to be wrapped.

My question is this: is there a way to load classes into the JVM (probably using a custom ClassLoader) such that any instances of those classes execute their methods with no permissions?

Thanks!