OpenBMB/IoA issue 18 describes a mismatch between the code-execution tool's stated isolation and its implementation. At the reported main-branch commit, the tool wrote and ran scripts through host subprocesses under the agent process's operating-system identity, rather than inside the described Docker sandbox. The caller-controlled filename was also joined…
Inspect the ClaimsCase · DiggingBeagle record
IoA's code executor ran on the host despite its Docker-sandbox description
An OpenBMB/IoA issue identified host subprocess execution and filenames escaping the intended work directory. The report is tied to a source commit; a malicious peer inducing a tool call is a separate prerequisite.
Public disclosure: Oct 14, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-IOA-EXEC-LOCAL-SUBPROCESS · OpenBMB IoA issue 18, local code executor without sandbox
At a glance
Prompt or peer control can become direct host execution or file replacement wherever an agent invokes this tool.
Read the implicationsSource-level report on main commit 9d78e88; a hostile peer convincing the target to call it is a separate prerequisite; no confirmed real victim or later fixed release.
Limits and uncertaintyFull account
OpenBMB/IoA issue 18 describes a mismatch between the code-execution tool's stated isolation and its implementation. At the reported main-branch commit, the tool wrote and ran scripts through host subprocesses under the agent process's operating-system identity, rather than inside the described Docker sandbox.
The caller-controlled filename was also joined to a work directory without adequate containment. That creates a filesystem boundary problem before execution as well as a process-isolation problem when the script runs. A timeout does not substitute for either boundary.
What the issue does and does not demonstrate
The report identifies the affected code and a controlled reproduction on commit 9d78e88. It does not establish a production victim, a complete affected-release range or a later fixed build. A hostile teammate persuading the agent to invoke the executor remains a separate condition; the source does not turn every team message into a demonstrated remote exploit.
The related WebSocket identity flaw concerns who can speak as an agent. It must not be represented as a demonstrated end-to-end chain with this executor issue. An authorized isolation test should separately check process identity, filesystem destinations and the principal permitted to request execution.
Mechanism and trust boundary
- 01
An IoA agent receives team content or a request that leads it to use the execute_code tool.
- 02
The tool writes a user-controlled filename under a joined directory path without rejecting traversal.
- 03
Python and shell execution runs under the same OS identity as the agent process instead of in the promised container.
Claims & evidence
CLM-IOA-EXEC-LOCAL-SUBPROCESSIssue 18 identifies im_client/agents/tools/code_executor.py executing scripts through the host subprocess, with filename paths not contained within its intended work directory.supported
Basis: reported finding
- supportsOpenBMB IoA issue 18, local code executor without sandboxprimary disclosure
Issue #18, Summary, Root cause and vulnerable source-code lines
Implications
Prompt or peer control can become direct host execution or file replacement wherever an agent invokes this tool.
Controls and mitigations
- Sandbox executable agent tools under a distinct low-privilege OS identity, validate canonical output paths and disallow host-shell operation as a default.
Unknowns and contradictions
- Source-level report on main commit 9d78e88; a hostile peer convincing the target to call it is a separate prerequisite; no confirmed real victim or later fixed release.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233