Audit Agent Code Execution: Prove Sandbox, Rotate Secrets
If generated code can inherit production environment variables, the sandbox is decorative; verify the execution path and rotate exposed credentials.
A default sandbox flag is not a boundary
Agents that execute generated code need a hard control between the model and the machine. The control is the execution path, the child process environment, and the permissions the child can reach.
PraisonAI, an agent package, has a CodeAgent._execute_python() function that runs LLM-generated Python in a subprocess with the full parent environment. In the vulnerable code, CodeConfig's sandbox=True setting is not enforced because _execute_python does not check that field. The subprocess receives environment variables including OPENAI_API_KEY, DATABASE_URL, and AWS credentials. The result is a direct path from generated code to production secrets.
The issue was assigned CVE-2026-61447 and rated critical with a CVSS 10.0 score. PraisonAI's praisonaiagents package versions up to 1.6.77 are affected, and 1.6.78 is the patched release. If your stack runs an affected version, ask whether the child process could read your credentials.
Five steps prove the sandbox is real
Use this checklist for any agent that can run model-generated code. Each step is testable in a minute if you have staging access and a way to inspect the child process.
- Map the generated-code entry point. Find the function that passes model output to an interpreter or shell. Trace the call from prompt to execution.
- Confirm the sandbox flag is checked in the execution path. A default value in a config object does nothing if the runner ignores it. Look for the branch that changes isolation, network access, or file access.
- Inspect the subprocess environment. Start the child in staging and dump its environment. Compare it with the parent. Any production credential in that dump is a leak.
- Restrict secrets to least privilege. Move production credentials out of the agent process. Give the child only the scopes the task needs, and keep destructive scopes out of reach.
- Rotate any secret that was visible to the process. Treat every environment variable the child could read as exposed. Rotate before you finish the audit, not after the postmortem.
The first step matters because generated code can arrive through many routes: a tool call, a file write, a notebook cell, or a direct interpreter call. If you cannot name the entry point, you cannot prove the sandbox applies.
The second step catches the pattern in the PraisonAI code path. A field named sandbox can default to true while the execution function never reads it. The flag is only real when the runner enforces it.
The third step is the fastest way to see the real exposure. Environment variables are the default inheritance channel for child processes. If the child can read them, the model can exfiltrate them through generated code.
The fourth step follows OWASP's 2026 LLM Top 10: minimum permissions, tools, and autonomy should be set outside the model.
The fifth step is the part operators skip. A secret that was visible to a compromised process is exposed. Rotate the credential before the next agent run.
Visible secrets are exposed secrets
OWASP's 2026 Top 10 for LLM Applications ranked sensitive information disclosure as the second-ranked threat for the second year running. The same guidance puts API keys in tool definitions among hidden context that should stay away from users and attackers. Sandboxing is recommended to limit what a model can reach in networks, internal services, and APIs.
Excessive agency rose from sixth to third in the 2026 list, covering excessive functionality, permissions, and autonomy. That ranking matches the failure mode here: an agent with code execution and inherited credentials can do more damage than a chatbot that only answers questions.
OWASP frames security as damage control: the system around the model must prevent important damage when the model is fooled. A sandbox flag that is never checked does not limit damage. It leaves the production environment inside the child process.
If the child process could read OPENAI_API_KEY, DATABASE_URL, or AWS credentials, rotate them now. If the version is below 1.6.78, upgrade and re-run the audit. If the sandbox flag is not checked in the execution path, treat the flag as false and isolate the runner.
The audit proves the machine is safe when the model is wrong. Generated code is a capability. The environment is the control. Rotate the credential, patch the runner, and re-run the audit.