Search papers, labs, and topics across Lattice.
The paper introduces CIBER, a novel benchmark for evaluating the security vulnerabilities of code interpreter agents against dynamic adversarial attacks. CIBER combines dynamic attack generation, secure sandboxing, and state-aware evaluation to assess vulnerabilities against prompt injection, memory poisoning, and prompt-based backdoors. Experiments on six foundation models using OpenInterpreter and OpenCodeInterpreter reveal that interpreter architecture and model alignment impact security baselines, and that natural language disguises are more effective attack vectors than explicit code.
Code interpreter agents are alarmingly susceptible to implicit semantic hazards disguised as natural language, bypassing typical syntax-based defenses.
LLM-based code interpreter agents are increasingly deployed in critical workflows, yet their robustness against risks introduced by their code execution capabilities remains underexplored. Existing benchmarks are limited to static datasets or simulated environments, failing to capture the security risks arising from dynamic code execution, tool interactions, and multi-turn context. To bridge this gap, we introduce CIBER, an automated benchmark that combines dynamic attack generation, isolated secure sandboxing, and state-aware evaluation to systematically assess the vulnerability of code interpreter agents against four major types of adversarial attacks: Direct/Indirect Prompt Injection, Memory Poisoning, and Prompt-based Backdoor. We evaluate six foundation models across two representative code interpreter agents (OpenInterpreter and OpenCodeInterpreter), incorporating a controlled study of identical models. Our results reveal that Interpreter Architecture and Model Alignment Set the Security Baseline. Structural integration enables aligned specialized models to outperform generic SOTA models. Conversely, high intelligence paradoxically increases susceptibility to complex adversarial prompts due to stronger instruction adherence. Furthermore, we identify a"Natural Language Disguise"Phenomenon, where natural language functions as a significantly more effective input modality than explicit code snippets (+14.1% ASR), thereby bypassing syntax-based defenses. Finally, we expose an alarming Security Polarization, where agents exhibit robust defenses against explicit threats yet fail catastrophically against implicit semantic hazards, highlighting a fundamental blind spot in current pattern-matching protection approaches.
