LOW
The severity rating is LOW due to the inherent sandboxing and isolation mechanisms. However, any misconfiguration or vulnerabilities in the sandbox providers could elevate risk. Real-world exploitability is low without specific weaknesses being exploited.

Open SWE is an open-source project inspired by internal coding agents developed at elite engineering organizations like Stripe, Ramp, and Coinbase. These agents are designed to operate within isolated cloud sandboxes with full permissions but no access to production systems. Open SWE uses a Deep Agents framework for orchestration and supports various sandbox providers such as Modal, Daytona, Runloop, and LangSmith. The architecture ensures that each task runs in its own environment, reducing the risk of cross-task interference or security breaches. This setup is particularly useful for automated PR creation and integration with tools like Slack and Linear, providing a comprehensive solution for automating development workflows. However, it also introduces potential vulnerabilities if proper isolation is not maintained, especially when dealing with sensitive codebases.

Affected Systems
  • Open SWE
Affected Versions: All versions
Remediation
  • Ensure all cloud sandboxes are configured with strict isolation policies to prevent unauthorized access and cross-task interference.
  • Regularly audit the system prompt and tool configurations for potential security flaws or misconfigurations that could lead to unintended behavior.
  • Update to the latest version of Open SWE to ensure you have the most recent security patches and improvements.
Stack Impact

Minimal direct impact. However, in a homelab setup using Open SWE with specific versions like Modal v1.2 or LangSmith v0.8, attention must be paid to sandbox configurations and tool permissions to prevent unintended access.

Source →