The sandbox flag changed nothing

CodeAgent._execute_python() ran the model's Python in a subprocess. It passed that subprocess the whole parent environment through os.environ.copy(). It ran whatever the model wrote. No AST check ran first, and no import was blocked. Whatever the parent held, the child could read.

The sandbox flag was the reason to expect otherwise. CodeConfig exposed a sandbox option that defaulted to true. The field was dead code. The only isolation was the subprocess, and a subprocess is not a sandbox.

Prompt injection is the entry point. An attacker who lands instructions in the agent's input, its tool results, or content it ingests can direct the generated code. That code runs with the parent's environment. API keys, database credentials, and cloud tokens sit in that environment.

The exfiltration is ordinary. The code reads the variables and sends them out, or it runs any command the model chooses. The advisory rates it 10.0, the maximum. One tool in the same package showed the contrast: the execute_code helper in python_tools.py passed env={}, an empty environment. The unsandboxed path did not.

The fix shipped in praisonaiagents 1.6.78. The OSV record is PYSEC-2026-4266, with a GHSA and an NVD entry under CVE-2026-61447. It affects the 0.x and 1.x lines before 1.6.78. A related flaw credited to the same reporter, CVE-2026-61443 in SkillTools, sits outside this window.

**Log take:** A sandbox option that is never read is worse than no option, because it buys trust it does not earn. The record here is a primary advisory with no confirmed in-the-wild use. *(Interpretation; vendor-published advisory, single flaw.)*