PraisonAI Subprocess Sandbox Security Policy Bypass

CVE-2026-60085 exposes a critical flaw in PraisonAI versions before 4.6.78 where the Subprocess Sandbox backend completely ignores all configured security restrictions. Despite administrators explicitly setting blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write policies, these controls are unenforced, allowing attackers to execute arbitrary subprocess commands, access sensitive files, and perform destructive operations. This vulnerability is particularly dangerous for organizations deploying PraisonAI as an AI agent platform, as it transforms what should be a sandboxed, controlled environment into an unrestricted execution context. Any user or compromised integration with access to PraisonAI can bypass intended security boundaries, making this a high-severity issue (CVSS 7.5) affecting the integrity and confidentiality of systems relying on these controls.

While CVE-2026-60085 has no mapped MITRE ATT&CK techniques listed, the attack patterns it enables align with command execution and file access abuse tactics. Practitioners using Casky.ai would detect suspicious activity through Claude's extended reasoning capabilities by identifying anomalous subprocess invocations, unauthorized file system access attempts, and import statements that violate configured policies. Security teams should monitor for execution patterns that conflict with documented sandbox rules—such as subprocess calls to dangerous commands when allow_subprocess is false, file writes to protected paths, or imports of restricted modules. Casky's skill correlation would highlight these policy violations across the 754 security skills mapped to ATT&CK, enabling practitioners to recognize and respond to exploitation attempts before attackers achieve persistent access or data exfiltration.