The agent development workflow admits code into the server container, where internal services and environment credentials may be reachable. Selecting a code-runner interface does not itself provide process isolation. Mechanism, preconditions and effects. In Coze Studio's make/make debug deployment, CODE_RUNNER_TYPE=local selects direct Python execution in…
Inspect the ClaimsCase · DiggingBeagle record
Coze debug deployment runs registered users' Python inside the server container
Scope
Reported local debug configurations; the advisory explicitly excludes the hardened make web Deno/Pyodide path.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-COZE-LOCAL-RUNNER reports: CVE-2026-77934 reports that make and make debug select an unrestricted local Python runner whose import filter can be bypassed by an authenticated, self-registered user. Source SRC-2026-RADAR-COZE-LOCAL-RUNNER is located at 'Overview, Root Cause and PoC; CODE_RUNNER_TYPE=local and direct/runner.go'. The distinctive mechanism begins: In Coze Studio's make/make debug deployment, CODE_RUNNER_TYPE=local selects direct Python execution in the server container. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Switch network-reachable instances to the production sandboxed runner and restrict internal service network reachability. Keyword checks against Python source cannot provide process isolation, and a sandboxed runner alone should not inherit production credentials. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-COZE-LOCAL-RUNNER · Coze CVE-2026-77934 local runner advisory
At a glance
No verified production compromise or container-to-host escape.
Limits and uncertaintyFull account
The agent development workflow admits code into the server container, where internal services and environment credentials may be reachable. Selecting a code-runner interface does not itself provide process isolation.
Mechanism, preconditions and effects. In Coze Studio's make/make debug deployment, CODE_RUNNER_TYPE=local selects direct Python execution in the server container. An authenticated user with code-runner access can evade the import keyword filter using dynamic import and reach container filesystem, process credentials and services on the shared Docker network. The security problem lies in the configured execution backend, not in an AI model deciding to call a shell without permission.
Comparison and evidence limits. The advisory explicitly exempts the make web production path that uses Deno/Pyodide isolation from this exact code path. Default credentials on nearby MySQL/MinIO/Redis services are a conditional escalation of the debug deployment, not a proved escape from Docker onto the physical host.
Claims & evidence
CLM-COZE-LOCAL-RUNNERCVE-2026-77934 reports that make and make debug select an unrestricted local Python runner whose import filter can be bypassed by an authenticated, self-registered user.supported
Basis: reported finding
- supportsCoze CVE-2026-77934 local runner advisoryprimary disclosure
Overview, Root Cause and PoC; CODE_RUNNER_TYPE=local and direct/runner.go
Controls and mitigations
- Switch network-reachable instances to the production sandboxed runner and restrict internal service network reachability. Keyword checks against Python source cannot provide process isolation, and a sandboxed runner alone should not inherit production credentials.
Unknowns and contradictions
- No verified production compromise or container-to-host escape.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183