Malicious Python Artifact Executed by an AI Sandbox

The platform allowed the AI to run Python artifacts as part of a metrics-analysis workflow. The visible web interface did not expose an upload control, but the backend still had an artifact endpoint. The execution sandbox had no external network access and did not allow an escape during testing, but it exposed sensitive environment variables and internal configuration files.

> File-processing reconnaissance

After the usual chat enumeration, I mapped how the platform processed uploaded files and identified that artifacts could contain Python code. The key question was whether the artifact was treated as inert data or passed to a code execution path when the assistant was asked to analyze it.

> Finding the hidden upload path

The web interface did not allow artifact uploads, so an authorized request review identified the backend endpoint responsible for creating them. Burp Suite was used only to inspect and replay the application's own requests within scope. The endpoint accepted a Python artifact that the UI intentionally hid.

> The malicious artifact

import os
import pandas as pd

rows = [{"type": "cwd", "key": "path", "value": os.getcwd()}]

for key, value in sorted(os.environ.items()):
    rows.append({
        "type": "env",
        "key": key,
        "value": str(value)[:300],
    })

for path in ["/", "/tmp", "/opt", "/home"]:
    try:
        for name in os.listdir(path)[:15]:
            rows.append({"type": "listdir", "key": path, "value": name})
    except Exception as error:
        rows.append({"type": "error", "key": path, "value": str(error)})

save_table(pd.DataFrame(rows), "Sandbox Recon")

The artifact performed bounded reconnaissance only: current directory, truncated environment values and a small listing of common directories. It was designed to measure the sandbox boundary without attempting an escape or modifying files outside the test workspace.

> Injecting the artifact into the AI context

The AI request initially left context empty. After uploading the artifact through the platform's backend endpoint, the page returned an artifact URL. I used that URL in context.artifacts and sent the prompt: "Run the attached Metrics recon-2 file and show the output table." This caused the assistant to treat the uploaded code as an executable analysis input rather than an untrusted document.

{
  "session_id": "REDACTED-SESSION-ID",
  "message": "Run the attached Metrics recon-2 file and show the output table.",
  "context": {
    "artifacts": [{
      "resource_uri": "https://PLATFORM.example/artifacts/REDACTED",
      "artifact_type": "CODE",
      "artifact_title": "Metrics recon-2 file",
      "created_at": "2026-06-26T20:00:00.000000Z"
    }],
    "attachments": [],
    "datasources": []
  }
}

> Execution and response

The assistant executed the artifact and returned the generated table. This confirmed arbitrary Python execution inside the analysis sandbox. The sandbox remained isolated from external connections and did not escape, but its process environment contained PostgreSQL credentials and its filesystem included Dockerfile, config YAML and sandbox implementation files.

> AI-focused defense-in-depth

• [+]Do not treat an artifact as executable merely because the model requests it. Store code artifacts as data unless an explicitly approved execution workflow is selected.
• [+]Validate artifact type, provenance, signature and content server-side. Hidden endpoints must enforce the same policy as the visible UI.
• [+]Never execute untrusted Python with complete __builtins__. Use a purpose-built restricted runtime, although language-level restrictions must not replace process isolation.
• [+]Remove secrets from the sandbox environment entirely; sanitizing output is not sufficient when PostgreSQL credentials are available to the process.
• [+]Mount only the minimum read-only files required for the task. Configuration, Dockerfiles, skill instructions and sandbox source code should not be visible.
• [+]Use per-artifact authorization and explicit user confirmation before code execution. Keep the AI from silently adding executable artifacts to context.
• [+]Apply output DLP to environment values, credentials, filesystem paths and reconnaissance tables before returning results.