Giving LLMs exec() power is a security nightmare. I built a open-source AST-based guardrail to stop malicious agent execution.

Reddit r/AI_Agents Tools
security open-source llm code-execution ast guardrails python

Summary

Introduces ast-guard, an open-source AST-based security tool that prevents malicious code execution from LLM-generated Python strings by parsing them into an abstract syntax tree and applying node-level whitelisting and context-aware safety checks.

Hi everyone, We all want AI agents that can write and execute their own code. But let’s be honest: blindly passing LLM-generated Python strings into exec() or an interpreter is a massive liability. Prompt engineering can be bypassed, and regex filtering is easily evaded by obfuscated code. To solve this for my own setups, I spent the last few weeks digging into the compiler level and built ast-guard. Instead of analyzing what the code looks like (strings/prompts), it analyzes what the code actually does by parsing the LLM output into an Abstract Syntax Tree (AST) before it ever touches an interpreter. How it secures the execution: •Node-Level Whitelisting: Dynamically blocks dangerous language constructs, unauthorized built-ins, and risky imports (like hidden subprocess or os calls) at the parser level. •Context-Aware Safety: It doesn't just block keywords; it understands if a library is being misused structurally. •Defense-in-Depth: Designed to act as the immediate, lightweight software-layer shield before you even need to spun up heavy Docker containers or WASM sandboxes. About me: I’m a completely self-taught engineer. I started from absolute scratch 6 months ago without an IT background, driven purely by curiosity for AI architecture. Because I am still learning, Im looking for honest feedback. The project is fully open-source. Link in the comments.
Original Article

Similar Articles

PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation

arXiv cs.LG

PropGuard is a propagation-aware framework for safeguarding LLM-based multi-agent systems (LLM-MAS) from malicious instructions that propagate across agents and rounds. It constructs a dual-view spatio-temporal graph and uses a GE-GRPO trained inspector to detect and remediate suspicious propagation subgraphs.