smolagents

Agent framework · Hugging Face · 4/7 verified · Last checked 2026-10-16

CodeAgent runs generated Python in a custom AST interpreter that blocks imports unless you allow them. For real isolation, the docs point to remote sandboxes like E2B, Modal or Docker.

Overall: C (1.75 avg, 4/7 controls verified)

Lock this down first

Use executor_type="e2b", "modal" or "docker" for any agent that touches untrusted input.

Scorecard

Criterion	Rating	Notes
Permission granularity	2/3	Imports and submodules are blocked unless added to an authorized list.
Human approval gates	Unverified	Not confirmed in the docs we checked.
Sandboxing	2/3	Off by default: the local interpreter is not a full security boundary. Remote sandboxes (E2B, Modal, Docker, Blaxel) are opt-in.
Secrets handling	1/3	In code-only remote mode, secrets are not transferred to the sandbox.
Audit logs	2/3	OpenTelemetry instrumentation logs agent runs to a backend you choose.
Kill switch / interrupt	Unverified	Not confirmed in the docs we checked.
Network egress control	Unverified	Not confirmed in the docs we checked.

Unverified: Human approval gates, Kill switch / interrupt, Network egress control. That means we could not confirm it in public docs, not that it is missing.

Sources

Vendor? Request a correction. We review corrections within 7 days.