World's Fair 2025
OpenAI on Securing Code-Executing AI Agents — Fouad Matin (Codex, Agent Robustness)
Overview
This talk addresses the critical security and safety considerations for AI agents capable of executing code. As AI models become increasingly proficient at writing and running code, the focus shifts from mere capability to responsible deployment and robust guardrails. The presentation emphasizes that code execution is becoming a standard feature for AI agents, moving beyond traditional software engineering tasks to achieve objectives more efficiently across various applications.
Who should watch
- AI Engineers
- Product Managers
- Builders working with code-executing AI agents
- Individuals concerned with AI security and robustness
- Developers looking to implement or understand agent sandboxing and control mechanisms
Key takeaways
- Frontier AI research is rapidly advancing coding capabilities and deployability of agents, making code execution a common feature.
- The primary challenge is shifting from "can models do this" to "what should they be allowed to do" and establishing appropriate guardrails.
- Code execution by AI agents can be leveraged for tasks beyond SWE, including image analysis via OCR or image cropping, demonstrating emergent capabilities when code execution is available.
- Potential failure modes for AI agents include prompt injection, data exfiltration, unintentional mistakes like installing malicious packages, and privilege escalation or sandbox escapes.
- Key safeguards for deploying code-executing agents include robust sandboxing (e.g., containerization, OS-level sandboxing), limiting or carefully controlling internet access, and requiring human review of agent operations.
- OpenAI's CodeX CLI is an open-source library designed to run code execution agents locally, showcasing sandboxing techniques for macOS and Linux.
- Disabling internet access is a high-probability vector for prompt injection and data exfiltration; configurable allow lists for network access are being introduced.
- Human review remains a strong mitigation, but practical implementations require balancing thoroughness with efficiency, avoiding excessive manual approvals.
Notable quotes
*It's not just actually about writing code but it's about achieving the objective most efficiently.*
*The new constraint isn't just can these models do things but actually what should they be able to do and what should the guardrails be.*
*The most common one, something we think about consistently is prompt injection and data exfiltration.*
Unofficial community note. Prefer the recording for nuance.