Inspect 0.3.286 locks down sandbox file access

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Petri 3.1.1 and inspect_evals 0.27.0 also close host-takeover and filesystem escape paths, and inspect_ai drops Python 3.10.

417 commits 438 PRs merged 19 releases 30 briefings covered

all ai-safety-evals reviews →

ai-safety-evals wire →

v0.3.286 UKGovernmentBEIS/inspect_ai

by github-actions[bot]

Docker `read_file()` now runs as the container's default execution user rather than through Docker's privileged copy API, so any code that relied on reading root-owned paths must pass user="root" explicitly. The release notes also list a fix that blocks writable host mounts, the change that most directly affects what a task's sandbox can reach on your machine.

fix: enforce filesystem boundaries for resources and exports safety-research/petri

by kaifronsdal

Resource searches could read outside `allowed_paths`: `search_in_files` ran the auditor's free-form grep arguments and only filtered output lines by filename prefix, which arguments like `-h . ../outside.txt` suppressed. If you run Petri against models you don't trust, 3.1.1 is the version that restores the guarantee the tool advertises.

fix: drop target tool options so providers cannot run tools server-side safety-research/petri

by kaifronsdal

Target tools were supposed to be synthetic, intercepted by the auditor on every call, but `ToolInfo.options` let inspect's model providers execute some of them inside the API call where the auditor never saw them. Seed tools passed those options straight through; 3.1.1 drops them.

$ ls ai-safety-evals/month/ # the briefings behind this review

Fri Oct 2 Petri 3.1.1 closes filesystem and server-side tool escapes Sat Oct 3 inspect_evals 0.23.0 fixes the HLE registry lookup error Sun Oct 4 Nova models stop breaking reasoning_effort evals Mon Oct 5 Inspect logs provider request ids, dataset shuffle takes an int seed Tue Oct 6 inspect_ai recovers stalled sandbox polls, control-arena ships v20.0.0 Wed Oct 7 inspect_ai closes sandbox bridge config leaks, inspect_evals restores official SWE-bench images Thu Oct 8 Haiku 5.5 lands in inspect_ai; variadic tools stop demanding args Fri Oct 9 Petri needs explicit realism roles, Opus 5.5 support lands Sat Oct 10 Inspect evals get reproducible answer shuffling, control-arena stops running docs code Sun Oct 11 Sentinel monitors gain task and sample descriptions Mon Oct 12 inspect_evals moves shared test tooling into pytest-inspect-evals 0.1.0 Tue Oct 13 Sentinel monitors gain model-call visibility, unhandled escalations now halt samples Wed Oct 14 Inspect blocks writable host mounts, control-arena rescues 6 weeks of swe_django side-task scores Thu Oct 15 Docker sandbox stops unpacking agent archives on your host Fri Oct 16 inspect_ai drops Python 3.10, grades stop failing on fenced JSON Sat Oct 17 Inspect adds tool state scopes, fixes usage undercounting Sun Oct 18 inspect_evals 0.25.0 rescores SWE-Lancer accuracy Mon Oct 19 Inspect AI ships an extensions and evals refresh Tue Oct 20 Inspect 0.3.282 scopes tool state per agent; sentinel gains step history and human decisions Wed Oct 21 Inspect's Perplexity provider moves to the Agent API, and inspect_evals drops web_browser Thu Oct 22 Inspect 0.3.283 breaks datasets that use a `checkpoint` field Fri Oct 23 Inspect logs stop mutating mid-run, Math.Calc regrades Sat Oct 24 inspect_evals 0.26.0 drops GAIA's browser tools; background subagent failures now fail samples Sun Oct 25 Viewer plays terminal sessions, Kimi K3.1 Pro lands in 0.3.284 Mon Oct 26 inspect_ai 0.3.285 adds a Terminals tab to the viewer Tue Oct 27 Inspect AI tightens log handling, BrowseComp swaps in web_search Wed Oct 28 End-to-end runs now come back without OverflowError Thu Oct 29 inspect_ai 0.3.286 enforces sandbox user permissions, and inspect_evals closes a host-takeover hole Fri Oct 30 inspect_evals 0.27.0 lands with AgentDojo locale fix and PaperBench solver change Sat Oct 31 Bridge agents stop killing samples, approvals see the real tool

all ai-safety-evals reviews →

ai-safety-evals wire →