Fuzzing smolagents' LocalPythonExecutor: silent sandbox bugs that degrade AI agent performance

Short summary

A developer fuzzed Hugging Face's smolagents LocalPythonExecutor sandbox with valid Python and found multiple silent failures: dict spread operators rejected with misleading NoneType errors, missing starred unpacking, frozen processes from big-integer ops, and silent no-op assignments. These bugs caused the AI agent to retry valid code in loops, burning LLM call budgets while producing worse outputs. The root cause was the sandbox not faithfully matching CPython AST semantics.

• •smolagents sandbox silently rejects valid Python (dict spread, starred unpacking, string unpacking)
• •Misleading error messages cause agents to retry in loops, wasting LLM call budgets
• •Sentry's Seer independently identified the same root cause from event data
• •Multiple CPython-matching bugs found across dict spread, big-int ops, and unpacking

Generated with AI, which can make mistakes.