PraisonAI Agents sandbox escape lets LLM code harvest env vars in v1.6.77

A critical security flaw in PraisonAI Agents has been identified, allowing attackers to steal sensitive credentials from the host environment. The vulnerability, tracked as CVE-2026-61447, affects versions up to 1.6.77 and has been resolved in the subsequent release.

What happened

The vulnerability resides within the `CodeAgent._execute_python()` function in the PraisonAI Agents package. According to the GitHub advisory, this function executes Python code generated by large language models in a subprocess. Crucially, it passes the complete parent-process environment variables to this subprocess using `os.environ.copy()`. This action exposes all secrets, including API keys, database credentials, and cloud tokens, to the running code.

The issue persists even when users explicitly configure `CodeConfig(sandbox=True)`. The advisory notes that this sandbox setting provides no actual protection in this context. Furthermore, the code execution lacks any Abstract Syntax Tree (AST) validation or import restrictions. The LLM-generated code is written directly to a temporary file and executed without scrutiny. This stands in contrast to other tools within the package, such as `execute_code` in `python_tools.py`, which correctly utilise an empty environment dictionary to isolate execution.

Why it matters

This flaw undermines the fundamental security promise of sandboxing in AI agent frameworks. Users who believed their environment variables were protected by the `sandbox=True` configuration were effectively unprotected. An attacker who can influence the LLM output through prompt injection, tool results, or ingested content can craft malicious code to exfiltrate these secrets. This allows for arbitrary code execution on the host machine with full access to sensitive configuration data. The severity is rated as critical due to the ease of exploitation and the high value of the exposed data.

Next steps

• Audit all PraisonAI Agents installations for versions 1.6.77 or lower.
• Upgrade to version 1.6.78 immediately to apply the vendor-provided fix.
• Review logs for any unauthorised subprocess executions or unusual API calls.
• Rotate any environment variables or credentials that may have been exposed.

What to do and how to stay safe: PraisonAI Agents

• Verify the version of PraisonAI Agents currently deployed in your environment.
• Monitor logs for unexpected Python subprocess executions or outbound network traffic.
• Rotate any API keys or credentials that were accessible to the agent's environment.
• Once the vendor provides an update, apply it promptly to mitigate the risk.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of PraisonAI Agents are affected by CVE-2026-61447?

All versions up to and including 1.6.77 are vulnerable. Version 1.6.78 contains the patch.

Does enabling sandbox=True protect against this vulnerability?

No. The advisory states that sandbox=True is ineffective in this specific code path.

How can an attacker exploit this flaw?

By influencing the LLM output via prompt injection or malicious input to execute code that reads environment variables.