CrewAI Code Interpreter Flaws Let Agents Escape Sandboxes
Enabled Code Interpreter lets prompt injection escape sandbox, execute code. Researchers found four linked CrewAI flaws: a Docker fallback to unsafe SandboxPython that permits arbitrary C-level calls, an SSRF in RAG search tools, a runtime Docker-check that triggers the unsafe fallback, and a JSON loader that reads arbitrary local files. An attacker who can influence an agent with the Code Interpreter enabled or a code-execution flag set can chain these bugs to escape the sandbox and run code or read files on the host.