Walk through AutoGen local code execution pattern and its sandboxing risk
Describe how AutoGen's local code execution flow works (which agent emits code, which agent runs it, where the output goes) and explain the production sandboxing risk that the default `code_execution_config` introduces.
AssistantAgent writes a fenced code block; UserProxyAgent parses it and runs it locally by default. Unsandboxed execution that prompt injection can hijack.
Picture two people sitting at a desk. The first person writes recipes on sticky notes and hands them across. The second person reads each note and immediately cooks whatever it says in your kitchen, using your knives and your stove. As long as the first person only writes recipes you would actually want to eat, life is fine. But if a stranger slips a fake note into the pile, the second person still cooks it, because they trust everything that arrives from the other side of the desk. The fix is to give the second person a tiny camping kitchen in a sealed tent. Anything they cook stays in the tent, gets thrown out at the end, and never touches your real kitchen.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
AutoGen's local code-execution pattern is one of the framework's most powerful features and one of its sharpest production traps. The power is that you can stand up a working code-writing agent in fifteen lines of Python. The assistant thinks, the proxy runs, the loop continues until the task is done. The trap is that the same fifteen lines, deployed as-is, hand the model shell access to your host.
This deep dive walks through the actual flow message by message, names the exact failure mode the default executor enables, and shows how the production-grade executor swap closes the hole without changing the agent logic.
The flow, message by message
AutoGen runs a conversation between named agents. For local code execution the canonical setup is two agents: an AssistantAgent backed by an LLM and a UserProxyAgent that owns the side-effect surface.
The loop begins when the proxy sends an initiating message. Usually the user's task description. The assistant receives it, the LLM produces a reply, and that reply lands back in the proxy's queue. The reply is plain text, but if the model decided the next step is to run code, it embedded a fenced block: triple-backtick python or sh followed by the code and a closing fence.
What the proxy actually does on receipt
The proxy has a chain of reply hooks. One of them, generate_code_execution_reply, scans the incoming message body for code fences using a regex. For each fence it finds, it asks the configured executor to run that block and collects the result.
The captured output, stdout, stderr, and exit code, is formatted as a Markdown block and becomes the proxy's next outgoing message. The assistant reads that output on its next turn and decides whether to write more code, ask a follow-up question, or emit the TERMINATE keyword the proxy is watching for.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
from autogen import AssistantAgent, UserProxyAgent
from autogen.coding import DockerCommandLineCodeExecutor
assistant = AssistantAgent(name='coder', llm_config={'model': 'gpt-4o'})
executor = DockerCommandLineCodeExecutor(
image='python:3.12-slim',
timeout=60,
work_dir='/sandbox',
)
proxy = UserProxyAgent(
name='runner',
human_input_mode='NEVER',
code_execution_config={'executor': executor},
)
proxy.initiate_chat(assistant, message='Plot the FFT of a noisy sine and save to out.png')Real products, models, and research that use this idea.
- Microsoft's AutoGen 0.4 documentation lists DockerCommandLineCodeExecutor as the recommended production executor.
- OpenAI Code Interpreter ships a per-session disposable container with no internet by default. The exact pattern AutoGen reproduces with the Docker executor.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you architect the executor so a successful sandbox escape still does not compromise customer data?
Run the executor pod in a separate namespace with no service-account token, no secrets mount, and egress restricted to a per-tenant proxy that enforces RBAC; treat the sandbox as untrusted even after hardening.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Leaving the default `code_execution_config` on in production because the demo notebook worked. Handing the model shell access to the host.
60 second bullets to scan on the way to the call.
Which AutoGen agent emits code and which one runs it
How code is extracted from messages (Markdown fences)
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.