Code-exec tool without sandbox

ID

code-exec-tool-without-sandbox

Severity

critical

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

OWASP LLM

LLM06:2025 — Excessive Agency

OWASP ASI

ASI05:2026 (secondary ASI02:2026)

Family

LLM06 — Excessive Agency

Red-team vectors

Sandbox Escape / RCE

Tags

ai_security

Description

A code-execution tool — a Python REPL, a shell tool, a code interpreter — is exposed to the model with no sandbox declaration. Model-driven code execution then runs unisolated, so a malicious or injected instruction executes arbitrary code with the agent’s privileges (RCE / sandbox escape). A tool with a recognised sandbox (Docker, gVisor, Firecracker, E2B, RestrictedPython, WASM) is not flagged.

Examples

tools = [PythonREPLTool()]   (1)
1 Code-execution tool with no sandbox declaration — flagged critical.

Running it inside a sandbox (E2B, docker.from_env(), RestrictedPython, …​) produces no finding.

Mitigation / Fix

  • Run code-execution tools inside a sandbox; drop privileges; restrict filesystem and network.

  • Prefer a managed code-interpreter service with isolation guarantees.