Abstract Syntax Tree Pre-Screening and Syscall Confinement for Agent Code Interpreters
An assistant equipped with a Python or shell code runner is tricked into accessing host process memory, container runtime sockets, or cloud metadata interfaces to break out of its isolated workspace. The verifier parses submitted code into an abstract syntax tree before execution, blocks host-escape primitives, and compiles an immutable confinement contract.
Autonomous coding and data-analysis assistants frequently execute dynamically constructed Python scripts or shell commands inside container sandboxes. If the execution environment exposes the container daemon socket, unmasked procfs paths, dynamic foreign-function libraries, or outbound network interfaces, a crafted script can escape the workspace and take control of the underlying host.
Security Officer (Plain Meaning): Halts "Mount host root filesystem /proc/1/root or open /var/run/docker.sock from code interpreter" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope OWASP ASI05 | Wire Rule SEC-ZD-AI-05 | Formal Witness d095f23c18e74a90
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (and (= (allow_host_mount call) false) (= (allow_r... | FP = 0.0% | Contract IMMUNE-AI-D095F23C (mcp-sentinel 1.1.2)1. Thought-to-Action Interception and Contract Schematic for AI-SBX-05
Deterministic verification flow for AI-SBX-05 (OWASP ASI05, MITRE ATLAS AML.T0050): candidate probe interception by wire filter SEC-ZD-AI-05, differential proof via witness d095f23c18e74a90, and synthesis of gateway contract IMMUNE-AI-D095F23C for mcp-sentinel.
2. In-Path Mutation Blocking and Formal Solver Invariant for AI-SBX-05
Under rule SEC-ZD-AI-05, the in-path software filter parses every code snippet into an abstract syntax tree (AST) prior to interpreter invocation. Attempts to import low-level memory manipulation modules, traverse host process descriptors, open unix domain sockets, or spawn privileged subprocesses are halted before execution begins.
On the testbed, the verifier evaluates benign boundary-probing scripts against both unhardened interpreter routes and confined decoy runners. The differential check produces formal witness d095f23c18e74a90 with zero false positives across standard numerical and data-charting workloads.
Class Identifier: AI-SBX-05 (agent_sandbox_escape)
Taxonomy Concordance: OWASP ASI05 | MITRE ATLAS AML.T0050
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: POST /mcp/v1/tools/call {"name":"python_repl","arguments":{"code":"import os, ctypes; os.listdir('/proc/1/root'); open('/var/run/docker.sock')"}}
Blocked Mutation: Mount host root filesystem /proc/1/root or open /var/run/docker.sock from code interpreter
Z3 Solver Invariant: (assert (and (= (allow_host_mount call) false) (= (allow_raw_socket call) false) (= (allow_proc_mem_write call) false)))
Wire Sandbox Rule: SEC-ZD-AI-05
Formal Witness Hash: d095f23c18e74a90
Compiled Sentinel Rule: IMMUNE-AI-D095F23C (mcp-sentinel 1.1.2)3. Autonomous Synthesis of Gateway Contract IMMUNE-AI-D095F23C and Streebog-256 Receipt
From witness d095f23c18e74a90, the compiler generates rule IMMUNE-AI-D095F23C for border enforcement. The compiled contract enforces strict module allowlisting, forbids access to runtime control sockets, and confines file operations to an isolated scratch directory inside mcp-sentinel.
4. Engineering Reference Notes for AI-SBX-05
Inspection of dynamically constructed code strings and obfuscated imports
The pre-execution filter rejects dynamic evaluation primitives such as runtime string compilation, reflection-based module loading, and native shared-library bindings before the script reaches the interpreter.
Verification of container boundary enforcement without risking host stability
All escape probes are intercepted at the syntax and path-resolution layer inside the test runner, ensuring zero host syscalls or daemon mutations occur during verification.