Agent Security: Guardrails & Code Sandboxing

1. The Threat Landscape: Why Agents Are Uniquely Vulnerable

Unlike static chatbots, autonomous agents have actuators (they can write files, send emails, and query databases). This capability introduces critical security vectors:

2. Sandboxing Dynamic Code Execution

Many advanced agents (e.g. data science agents) write and execute Python code dynamically. Running generated code on the host operating system with exec() is catastrophic.

3. Hands-On Python: AST Security Scanner for Agent Code

Before sending generated code to any execution engine, statically inspect the syntax tree to reject dangerous imports:

import ast

FORBIDDEN_MODULES = {"os", "sys", "subprocess", "socket", "shutil", "builtins", "requests"}
FORBIDDEN_CALLS = {"eval", "exec", "compile", "__import__", "open"}

def inspect_code_safety(code_str: str) -> bool:
    try:
        tree = ast.parse(code_str)
    except SyntaxError:
        return False, "Invalid Python syntax"
        
    for node in ast.walk(tree):
        # 1. Block forbidden imports: import os, from subprocess import Popen
        if isinstance(node, ast.Import):
            for alias in node.names:
                if alias.name in FORBIDDEN_MODULES:
                    return False, f"Security Violation: Forbidden import '{alias.name}'"
        elif isinstance(node, ast.ImportFrom):
            if node.module in FORBIDDEN_MODULES:
                return False, f"Security Violation: Forbidden import from '{node.module}'"
                
        # 2. Block direct dangerous calls: eval(), open()
        elif isinstance(node, ast.Call):
            if isinstance(node.func, ast.Name) and node.func.id in FORBIDDEN_CALLS:
                return False, f"Security Violation: Forbidden function call '{node.func.id}'"
                
    return True, "Code passed static safety analysis"

4. Tri-Rail Defense Architecture (NeMo Guardrails)

Enterprise agent architectures implement three distinct layers of rail defense: