Code Interpreter — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP) to generate code. The primary threat is prompt injection forcing the model to generate malicious code designed to probe or escape the execution environment.

Not certain from the listing — The agent does not explicitly mention a persistent database, vector store, or RAG pipeline. The primary data risk is the temporary exposure of sensitive files or data payloads passed into the microVM for processing.

The agent acts as an MCP tool server. The primary framework risk is insecure tool integration where the orchestrating agent blindly executes code generated by the LLM without validation, potentially leading to unintended state changes within the sandbox.

This is the primary layer of both risk and defense. The agent executes arbitrary code in isolated E2B microVMs. Threats include sandbox escape, resource exhaustion (DoS), and lateral movement attempts within the cloud infrastructure hosting the microVMs.

The agent captures stdout and stderr from the executed code. However, there is a risk of insufficient logging of malicious system calls or network activity originating from within the microVM, creating an observability blind spot.

Not certain from the listing — While the microVM provides strong isolation, the listing does not detail the authentication, authorization, or rate-limiting policies governing who can spin up and execute code within these sandboxes.

As an MCP server, this agent is designed to be called by other agents. A compromised orchestrator agent could abuse this tool to run malicious payloads, turning the code interpreter into a utility for distributed attacks or lateral exploitation.