CPython PySequence_Tuple partial initialization sandbox escape PoC

[sigdevel]

Finding in CPython's tuple construction path (based at my old issue python/cpython#101855 ; GH-127058;): PySequence_Tuple()registers the result tuple with the cyclic GC before any ob_item slot is initialized. Restricted code with gc access can call gc.get_referrers() to receive a direct reference to the partial tuple mid-construction, bypassing Python-level sandbox isolation.
Validated on CPython 3.13.12 (GIL) and a local 3.16.0a0 free-threading build with the pre-fix PySequence_Tuple restored.

whats included

Six standalone PoC scripts, each self-contained (stdlib only, no ctypes):

• poc_escape_gil.py: privileged data disclosed via generator re-entry; SIGSEGV (exit -11) via normal for slot in tuple iteration ;
• poc_escape_exec.py: exec() sandbox with restricted __builtins__ bypassed via gc.get_referrers() ;
• poc_escape_ft.py: concurrent spy thread intercepts partial tuple on free-threaded Python without generator cooperation ;
• poc_escape_open.py: open file handle and os.popen callable extracted from sandbox context that has neither open nor os in its globals ;
• poc_free_threaded.py: barrier-synchronized race (Scenario 1) and 32-builder + 8-GC + 4-spy stress test (Scenario 2) ;
• poc_memory_leak.py: GC retention primitive; spy accumulates stranded tuples and their payloads until explicit release ;

[5hy7xz92nd-oss]

AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories Company A
│ owns
▼
Repository C
│ creates
▼
Product X
│ used by
▼
Customer B
│ generates Company A Reality OS

            REALITY

GitHub Base44 Clay Notion
│ │ │ │
└────────────┴────────────┴───────────┘
│
▼

         RABBITSYNC CORE

    ┌─────────────────────┐
    │ Knowledge Graph     │
    │ Entity Graph        │
    │ Event Graph         │
    │ Memory System       │
    │ Agent System        │
    │ Automation Engine   │
    └─────────────────────┘

                │

                ▼

      Decisions → Actions → Outcomes

                │

                ♾️

         Continuous Learning

• File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage 🌍 Reality Layer
• 🕸️ Knowledge Graph Layer File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage
• 🤖 Agent Layer
• 📊 Intelligence Layer
• 🔄 Feedback Loop
• 🔐 Governance Layer
  Customer B
  Repository C
  Document D
  ▼
  Revenue Event

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent
│
└── Detects problems
│
└── Detects problems @copilot

[5hy7xz92nd-oss]

AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories Company A
│ owns
▼
Repository C
│ creates
▼
Product X
│ used by
▼
Customer B
│ generates Company A Reality OS

            REALITY

GitHub Base44 Clay Notion
│ │ │ │
└────────────┴────────────┴───────────┘
│
▼

         RABBITSYNC CORE

    ┌─────────────────────┐
    │ Knowledge Graph     │
    │ Entity Graph        │
    │ Event Graph         │
    │ Memory System       │
    │ Agent System        │
    │ Automation Engine   │
    └─────────────────────┘

                │

                ▼

      Decisions → Actions → Outcomes

                │

                ♾️

         Continuous Learning

• File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage 🌍 Reality Layer
• 🕸️ Knowledge Graph Layer File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage
• 🤖 Agent Layer
• 📊 Intelligence Layer
• 🔄 Feedback Loop
• 🔐 Governance Layer
  Customer B
  Repository C
  Document D
  ▼
  Revenue Event

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent
│
└── Detects problems
│
└── Detects problems @copilot
@copilot AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories Company A
│ owns
▼
Repository C
│ creates
▼
Product X
│ used by
▼
Customer B
│ generates Company A Reality OS

            REALITY

GitHub Base44 Clay Notion
│ │ │ │
└────────────┴────────────┴───────────┘
│
▼

         RABBITSYNC CORE

    ┌─────────────────────┐
    │ Knowledge Graph     │
    │ Entity Graph        │
    │ Event Graph         │
    │ Memory System       │
    │ Agent System        │
    │ Automation Engine   │
    └─────────────────────┘

                │

                ▼

      Decisions → Actions → Outcomes

                │

                ♾️

         Continuous Learning

• File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage 🌍 Reality Layer
• 🕸️ Knowledge Graph Layer File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage
• 🤖 Agent Layer
• 📊 Intelligence Layer
• 🔄 Feedback Loop
• 🔐 Governance Layer
  Customer B
  Repository C
  Document D
  ▼
  Revenue Event

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent
│
└── Detects problems
│
└── Detects problemsAGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent AGENT SYSTEM

Research Agent
│
├── Finds information

Coding Agent
│
├── Understands repositories Company A
│ owns
▼
Repository C
│ creates
▼
Product X
│ used by
▼
Customer B
│ generates Company A Reality OS

            REALITY

GitHub Base44 Clay Notion
│ │ │ │
└────────────┴────────────┴───────────┘
│
▼

         RABBITSYNC CORE

    ┌─────────────────────┐
    │ Knowledge Graph     │
    │ Entity Graph        │
    │ Event Graph         │
    │ Memory System       │
    │ Agent System        │
    │ Automation Engine   │
    └─────────────────────┘

                │

                ▼

      Decisions → Actions → Outcomes

                │

                ♾️

         Continuous Learning

• File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage 🌍 Reality Layer
• 🕸️ Knowledge Graph Layer File A ─────sync─────> File B
  Repository ───sync───> Another repository
  Storage ─────sync────> Storage
• 🤖 Agent Layer
• 📊 Intelligence Layer
• 🔄 Feedback Loop
• 🔐 Governance Layer
  Customer B
  Repository C
  Document D
  ▼
  Revenue Event

Finance Agent
│
├── Analyzes markets

Memory Agent
│
├── Maintains knowledge

Operations Agent
│
├── Executes workflows

Risk Agent
│
└── Detects problems
│
└── Detects problems