Security context

Highlights

Sandbox Escape: 15 prior fixes. Scrutinize any change in this area.

src/smolagents/local_python_executor.py: most-fixed (18 issues). Treat as high-risk during review.

20 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Sandbox Escape: The local Python execution environment is the primary attack surface. Attackers repeatedly bypassed sandbox boundaries using dunder methods, builtins, and un-authorized imports to achieve remote code execution. Continuous hardening of AST validation and blocking unauthorized builtins is critical.

Deserialization: Insecure deserialization using pickle.loads in remote executors and serialization wrappers allowed arbitrary code execution. The application must enforce strict validation controls or default to safe formats like JSON to prevent remote code injection during agent deserialization.

Denial of Service: Untrusted code execution paths lacked strict resource constraints, allowing infinite loops or long-running operations to exhaust system resources. Mitigations require wrapping the AST evaluator with thread-pool-based timeout mechanisms.