Code-exec tool without sandbox
ID |
code-exec-tool-without-sandbox |
Severity |
critical |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
OWASP LLM |
LLM06:2025 — Excessive Agency |
OWASP ASI |
ASI05:2026 (secondary ASI02:2026) |
Family |
LLM06 — Excessive Agency |
Red-team vectors |
Sandbox Escape / RCE |
Tags |
ai_security |
Description
A code-execution tool — a Python REPL, a shell tool, a code interpreter — is exposed to the model with no sandbox declaration. Model-driven code execution then runs unisolated, so a malicious or injected instruction executes arbitrary code with the agent’s privileges (RCE / sandbox escape). A tool with a recognised sandbox (Docker, gVisor, Firecracker, E2B, RestrictedPython, WASM) is not flagged.
A named code-exec tool (PythonREPLTool, ShellTool, CodeInterpreter*, …) counts wherever it appears. A bare execution primitive — subprocess.run, subprocess.Popen, os.system — counts only inside an AI artefact (a file with an agent / tool / framework signal, or a skill / agent manifest), because on its own it is just a program running a program: a CI helper shelling out to git is not a tool exposed to a model. Members of subprocess that do not spawn a process, such as the subprocess.TimeoutExpired exception, are never a code-exec surface.