pydantic

Pydantic AI's DNS-Rebind Bypass of Its Egress Allowlist Originally published at webofmike.com on 2026-11-06. The demo repo and every command in it were run before publishing. A DNS record that changes between the moment code checks it and the moment code uses it can beat an egress allowlist that resolves a hostname twice. Pydantic AI patched exactly that bug on 2026-11-04, across v2.66.0, v1.107.10, and pydantic-ai-harness 0.66.0, inside a batch of 10 security advisories disclosed at once. Two of the ten are the same bug class I keep writing about on this site: an egress decision that lives in application code instead of the network. GHSA-5ppx-9jq6-6pmw (low): allowed_domains on the local web-fetch tool, and PlaywrightBrowser's egress allowlists, resolved a hostname to check it against the allowlist, then connected to the hostname, which resolved it again. Two lookups, and nothing forced them to agree. GHSA-5fj9-5pjw-vpwc (medium): the cloud-metadata blocklist that URL downloads check was missing Tencent Cloud's instance-metadata address, 169.254.0.23, so someone who can hand the application a URL could have it fetch temporary role credentials from that address. Neither bug is exotic. The first is DNS rebinding, a technique that's been public for two decades. The second is just an incomplete list. What's worth sitting with is where both checks lived: inside the agent framework, in the same process as the code an attacker is trying to redirect. I built a small, runnable repo that reproduces the shape of both bugs and shows the alternative: pydantic-ai-egress-bypass-demo. Disclosure: I work at Solo.io, which makes agentgateway. This post names it as one option for where egress enforcement can live; it is not a claim that agentgateway is immune to its own bugs. The bug: two lookups, one chance for them to disagree Here's the pattern GHSA-5ppx-9jq6-6pmw describes, reduced to its essence. A function checks whether a hostname is allowed by resolving it once: def is_hostname_allowed(hostname: str, port: int) -> bool: ip = socket.getaddrinfo(hostname, port)[0][4][0] return ip not in BLOCKLIST_IPS Then the code connects, separately: def fetch(hostname: str, port: int, path: str) -> str: if not is_hostname_allowed(hostname, port): raise PermissionError(f"{hostname} resolved to a blocked IP") sock = socket.create_connection((hostname, port), timeout=3) ... socket.create_connection() takes a hostname, not an IP, so it resolves the hostname again, internally. If DNS answers differently on the second lookup than the first, the check and the connection are checking two different things. That's not a hypothetical: a DNS record with a short TTL, under an attacker's control, can return a safe-looking address on the first query and a forbidden one, like a cloud metadata IP, on the second. My demo's vulnerable_fetch.py reproduces exactly this. A mock resolver (rebind_resolver.py) answers the first lookup of a test hostname with an RFC 5737 documentation address and every lookup after that with the address where a fake metadata endpoint is listening. Running it: $ python3 vulnerable_fetch.py [check] resolved api.example-safe.test -> 203.0.113.10 for the allowlist check [connect] connected to api.example-safe.test:8169 (second, independent resolution) [result] response body: 'FAKE-ROLE-CREDENTIAL-STAND-IN-FOR-CLOUD-METADATA-DO-NOT-USE' VULNERABLE: fetched the forbidden endpoint despite the allowlist check The check passed. The fetch didn't go where the check looked. The app-level fix: resolve once, pin the IP Pydantic AI's actual fix reorders the check to run before resolution instead of after it. A functionally equivalent fix for this reduced version: resolve the hostname exactly once, check that single result, and connect to the IP you already resolved rather than letting the hostname resolve again. def fetch(hostname: str, port: int, path: str) -> str: ip = socket.getaddrinfo(hostname, port)[0][4][0] # resolve ONCE if ip in BLOCKLIST_IPS: raise PermissionError(f"{hostname} resolved to a blocked IP ({ip})") sock = socket.create_connection((ip, port), timeout=3) # connect to the PINNED ip ... $ python3 fixed_fetch.py [check] resolved api.example-safe.test -> 127.0.0.1 for the allowlist check BLOCKED: api.example-safe.test resolved to a blocked IP (127.0.0.1) One resolution, one decision, one connection using that decision. This closes the specific bug. It does not close the category of bug, because the fix lives in exactly the same place the bug did: inside the application, reimplemented correctly this time, in this language binding, in this framework, this release. The next framework, or the next contributor who touches this code path, starts from zero again. Moving the check out of the app entirely The alternative is to stop deciding egress policy in the agent's own process at all. A proxy in front of the agent can resolve a destination once and enforce the policy there, and it doesn't matter whether the client behind it has a TOCTOU bug, an incomplete blocklist, or no check whatsoever. egress_proxy.py in the demo is about 70 lines: it reads an absolute-URI HTTP request, resolves the target hostname exactly once, checks that IP against a blocklist, and either returns 403 or connects to the pinned IP and relays the response. fetch_through_proxy.py is a client with no allowlist logic of its own, standing in for "whatever bug hits the app's own egress code next": $ python3 fetch_through_proxy.py [proxy] GET http://api.example-safe.test:8169/ -> resolved api.example-safe.test -> 127.0.0.1 [proxy] BLOCKED: 127.0.0.1 is on the egress blocklist [client] no allowlist check performed; proxy returned HTTP 403 [result] body: 'blocked by egress_proxy policy' BLOCKED: the proxy enforced the policy even though the client never checked The client never resolved anything, never compared an IP to a blocklist, never made a decision. It didn't need to. The policy held because it lived somewhere the client's own bugs can't reach. This is the argument for agentgateway as an egress policy enforcement point, which I built a standalone proof of and tested against proxy-variable bypasses back in September and October. A cloud-metadata blocklist, correctly maintained, has to enumerate every provider's instance-metadata address and keep enumerating as providers add more. A gateway that authorizes the resolved destination at connect time, once, in one place, doesn't need the enumeration to be perfect in every agent framework that might ever run behind it. It needs to be correct once. Running it yourself No dependencies beyond the Python 3 standard library, no sudo, no Docker: git clone https://github.com/themsquared/pydantic-ai-egress-bypass-demo.git cd pydantic-ai-egress-bypass-demo bash demo.sh demo.sh starts a fake metadata endpoint, runs the vulnerable fetch (expect VULNERABLE, exit 1), runs the fixed fetch (expect BLOCKED, exit 0), starts the egress proxy, and runs the no-check client through it (expect BLOCKED, exit 0). I ran it three times back to back before publishing this to make sure nothing depended on process-timing luck. One thing worth naming if you adapt this: the first version of egress_proxy.py bound port 8888, and on my own machine that collided with an unrelated server I had running from a different project. socketserver.ThreadingTCPServer doesn't set allow_reuse_address by default either, which meant a quick restart during testing hit OSError: [Errno 48] Address already in use from a TIME_WAIT socket, not a real conflict. Both are in the repo's final version: a non-default port, and allow_reuse_address = True on the server classes. What this demo doesn't verify It models the shape of GHSA-5ppx-9jq6-6pmw and GHSA-5fj9-5pjw-vpwc; it isn't a reproduction of pydantic-ai's actual code path, and it doesn't run a real DNS rebind over the network with an external resolver, since the "DNS" here is an in-process mock built for determinism. egress_proxy.py is a teaching toy, not a production gateway: no TLS inspection, no SNI-based policy, no CONNECT tunneling. Ten advisories in one batch isn't a reason to single out Pydantic AI; disclosing ten at once instead of trickling them out is the responsible move. It's a reason to notice where egress decisions keep ending up by default, which is wherever the request happens to originate, and to ask whether that's actually where you want them. The repo is at pydantic-ai-egress-bypass-demo if you want to run the rebind yourself. Frequently asked questions What is a DNS rebinding bypass of an egress allowlist? It's a check-then-use bug: code resolves a hostname to decide if it's allowed, then connects to the hostname again, which resolves it a second time. If an attacker controls that DNS record, the first lookup can return a safe address and the second a forbidden one, like a cloud metadata IP. The allowlist check passed; the connection didn't go where it checked. How did Pydantic AI fix GHSA-5ppx-9jq6-6pmw? Pydantic AI's allowed_domains and PlaywrightBrowser egress allowlists checked a hostname by resolving it once, then connected by resolving the same hostname a second time, so a short-TTL DNS record under an attacker's control could answer those two lookups differently. v2.66.0 and v1.107.10, both dated 2026-11-04, reorder the check to run before resolution instead of after it, so there's no second, independent lookup left to disagree with the first. Why put egress enforcement in a gateway instead of the agent framework's own code? Because a network proxy resolves a destination once, checks that single result, and connects to the pinned IP, with no second lookup to disagree with the first. It enforces the same policy for every agent behind it regardless of which framework, version, or language each one runs, so a bug in one app's allowlist code doesn't matter. What other bugs shipped in Pydantic AI's 2026-11-04 security batch? Ten advisories landed together in v2.66.0, v1.107.10, and pydantic-ai-harness 0.66.0. The other one worth knowing: GHSA-5fj9-5pjw-vpwc, a cloud-metadata blocklist missing Tencent Cloud's instance-metadata address (169.254.0.23), so a URL download could reach it and read temporary role credentials on affected deployments. --- *Canonical version, with machine-readable markdown at https://webofmike.com/pydantic-ai-egress-dns-rebind/index.md: webofmike.com

敢让 agent 直接跑它写的 Python 代码吗？ Monty 是 Rust 写的安全沙箱：AI 写的代码在里面碰不到文件、环境变量和网络，起新沙箱不到 1 毫秒。 开源版是 MIT，适合让 agent 放心跑代码的人。 你让 agent 跑过它写的代码吗？ #Python #AI安全 @grok pydantic/monty

OpenAI, Hugging Face, Google: Why They All Reach for Rust OpenAI rewrote Codex CLI in Rust. Hugging Face's tokenizers, safetensors, uv and Ruff all run on Rust. Why does a Python world keep reaching for it? The problem Rust solves (speed or safety), where it already runs in AI, what it honestly costs, and the plan for this series: Rust from zero, one picture at a time. Chapters 0:00 AI keeps reaching for Rust 0:46 The problem: speed or safety 1:34 What Rust does differently 2:03 Does it work? Android's numbers 2:40 Where Rust runs in AI today 4:04 Is Rust replacing Python? 4:29 The honest cost 4:59 The plan: two playlists 5:28 What would you build? Next: Episode 1: Your first Rust program The whole series, in order: Learn Rust from Zero (Beginners) · Rust You Can See (playlist) Sources - OpenAI Codex CLI rewrite: codex#1174 - Hugging Face tokenizers: huggingface/tokenizers - safetensors joins the PyTorch Foundation: pytorch.org - uv: astral-sh/uv · Ruff: astral-sh/ruff - Astral agrees to join OpenAI: astral.sh - Microsoft, ~70% of CVEs are memory safety: microsoft.com - Chromium memory safety: chromium.org - Android memory safety: security.googleblog.com · blog.google - The Case for Memory Safe Roadmaps (2023): cisa.gov - Linux 6.1 (Rust support): kernelnewbies.org - Stack Overflow 2025 survey: survey.stackoverflow.co - GitHub Octoverse 2025: github.blog - TypeScript's native port in Go: devblogs.microsoft.com - Rust compiler performance survey 2025: blog.rust-lang.org - Pydantic core: pydantic/pydantic-core · Polars: pola.rs Ferris the crab is the Rust community's mascot (public domain, rustacean.net). Rust You Can See is an independent series, not affiliated with or endorsed by the Rust Project or the Rust Foundation. Rust is a trademark of the Rust Foundation. Narration: AI-generated voices. #rust #learnrust #programming [es] Por qué la IA se está pasando a Rust [fr] Pourquoi l'IA se tourne vers Rust [hi] AI अब Rust पर क्यों शिफ्ट हो रहा है? [ja] なぜAIはRustへ移行しているのか [ko] AI가 Rust로 옮겨가는 이유 [pt-BR] Por que a IA está migrando para Rust

便利なAIが増えるほど、問われるのは何でも覚えている能力だけではありません。 人間が止めたことを、きちんと止められるか。 その境界を守ることも、AIを社会で使うための重要な条件です。 #ぶるーすかい？ 【GitHub一次資料】 不具合の報告・再現 pydantic-ai#11264 私の指摘 pydantic-ai#11264 メンテナによる修正・テスト・マージ pydantic-ai#11394

Pydantic AI's MCP telemetry could leak auth tokens into OpenTelemetry spans even with `include_content=False`. Fixed in 2.58.0 / 1.107.8. Old traces still need access review and credential rotation. github.com/pydantic/pydantic-ai/security/advisori…

Rust Didn't Win Because It's Fast GitHub rewrote Copilot's runtime in Rust. OpenAI's Codex is now almost all Rust. Bun, the runtime Claude Code ships on, moved 535,496 lines of Zig to Rust in 11 days. But it isn't about speed: C has been fast for half a century. We fly inside a real laptop, down to the CPU die and the memory cells, to show what Rust actually changed, and why AI coding agents love it. 0:00 Everyone is rewriting in Rust 0:49 This is Sidequest Explained 1:00 Inside the machine: instructions, bytes, stack and heap 1:53 Way one: freeing memory by hand (C and C++) 2:23 An elevator crash started Rust 2:40 Way two: the garbage collector (Discord's spikes) 3:12 Way three: ownership 3:36 Checked before it runs, and Android's results 4:07 Close to the metal: 28 bytes vs 8 4:21 Copilot: 5.25 s to 292 ms 4:41 Why AI agents love the Rust compiler 5:11 Is Python dead? What it means for you Sources GitHub Blog, migrating the Copilot runtime to Rust (Sep 2026): github.blog Bun, Rewriting Bun in Rust (Jul 2026): bun.sh OpenAI Codex repository: openai/codex Codex native rewrite discussion: codex#1174 Grok Build repository: xai-org/grok-build Dennis Ritchie, The Development of the C Language: bell-labs.com Microsoft MSRC, 70% of security bugs are memory safety (2019): microsoft.com Chromium memory safety: chromium.org MIT Technology Review, Rust's origin (2023): technologyreview.com Rust 1.0 announcement: blog.rust-lang.org Discord, Why Discord is switching from Go to Rust (2020): discord.com The Rust Book, ownership and borrowing: doc.rust-lang.org Google, memory-safe languages in Android 13 (2022): security.googleblog.com Google, Rust in Android (Nov 2025): blog.google Python sys.getsizeof / CPython ints: docs.python.org Hugging Face tokenizers: huggingface/tokenizers OpenAI tiktoken: openai/tiktoken pydantic-core: pydantic/pydantic-core uv by Astral: astral-sh/uv Numbers are the sources' own. The Copilot timings are client + session + one-turn overhead in the opt-in in-process mode, not counting the model or network. Android's 1000× is memory-safety vulnerability density. Code on screen is an illustration, not a run. Credits Die micrographs: Fritzchens Fritz (CC0). Memory-cell micrograph (Micron MT4C1024) and SEM plate (1886VE10): ZeptoBars, CC BY 3.0. Office and hardware photos: Pexels. HDRIs and materials: Poly Haven, ambientCG (CC0). Music: "Lofi Study" by FASSounds (Pixabay). Rust, GitHub, Copilot, OpenAI, Codex, Bun, Claude, xAI, Grok, Microsoft, Chrome, Android, Discord, Python, Hugging Face, Astral, pydantic and other names and logos belong to their owners, used for identification and commentary; Sidequest is not affiliated with any of them. Narration: an AI clone of my own voice. Animation: original, built in three.js. #rust #programming #ai

include_content=False Didn't Stop pydantic-ai's MCP Token Leak Originally published at webofmike.com on 2026-10-26. The demo repo and every command in it were run before publishing. pydantic-ai shipped two security fixes on 2026-10-19. The one I reproduced, GHSA-xv4x-g8mx-ch56, is a two-flag problem: include_content=False does exactly what it says for prompts and tool calls, and a second, separate flag still wrote MCP server URLs, authorization tokens, and custom header values into an OpenTelemetry span in plaintext. I built themsquared/pydantic-ai-mcp-telemetry-leak to see the exact span attribute that leaked, confirm the fix closes it, and confirm the thing include_content=False was actually supposed to cover still works. What the advisory covers pydantic-ai lets an agent reach an MCP server two ways. MCPToolset is pydantic-ai's own client: it connects to the server directly, and the URL and headers never leave your process. MCPServerTool is provider-native: you hand the server's URL, an authorization_token, and headers to the model provider (Anthropic, OpenAI Responses, xAI), and the provider connects to the MCP server on your agent's behalf. Anthropic's beta MCP connector and OpenAI Responses' remote MCP tool both work this way. That provider-native config has to travel somewhere: it's part of the request pydantic-ai builds for the provider's API. pydantic-ai's own instrumentation layer records that request shape in an OpenTelemetry span, under the attribute model_request_parameters, so you can see what tools and settings a call used. Before 2.58.0, that attribute included the full MCPServerTool dataclass, authorization_token and headers included, regardless of include_content. Reproducing it without a network call The leak lives in pydantic-ai's instrumentation code (_instrumentation.py), which wraps every model provider identically. That means I didn't need a real Anthropic account, a real MCP server, or even network access to reproduce it: any Model subclass that declares it supports MCPServerTool exercises the same span-building path. class StubModel(Model): """Smallest possible Model: returns a canned response, no network, no API key.""" async def request(self, messages, model_settings, model_request_parameters): return ModelResponse( parts=[TextPart(content="ok")], usage=RequestUsage(input_tokens=1, output_tokens=1), model_name="stub", timestamp=datetime.now(timezone.utc), ) @classmethod def supported_native_tools(cls): return frozenset({MCPServerTool}) Wrap it in InstrumentedModel with include_content=False, the setting someone reaches for specifically to keep prompts and tool arguments out of traces, and hand it a native MCP tool config carrying a fake token: mcp_tool = MCPServerTool( id="internal-billing-mcp", url="https://internal-mcp.example.com/mcp", authorization_token="sk-mcp-prod-SUPER-SECRET-TOKEN-abc123", headers={"X-Tenant-Key": "tenant-9f8e-SECRET"}, ) settings = InstrumentationSettings(include_content=False) model = InstrumentedModel(StubModel(), settings) params = ModelRequestParameters(native_tools=[mcp_tool]) await model.request(messages, None, params) Capture the span with an in-memory OpenTelemetry exporter and read model_request_parameters back off it. What came back Against pydantic-ai-slim==2.56.0, with include_content=False set on this exact span: {"native_tools":[{"kind":"mcp_server","id":"internal-billing-mcp", "url":"https://internal-mcp.example.com/mcp", "authorization_token":"sk-mcp-prod-SUPER-SECRET-TOKEN-abc123", "headers":{"X-Tenant-Key":"tenant-9f8e-SECRET"}}], ...} The token and the custom header are both right there, unredacted, on a span whose whole point was to not carry sensitive content. Meanwhile, on the same span, gen_ai.input.messages correctly came back as structure only, [{"role":"user","parts":[{"type":"text"}]}], no actual prompt text. include_content=False worked exactly as documented for the thing it's documented to cover. It just doesn't cover model_request_parameters, which ships under its own flag, include_model_request_parameters, defaulting to True. Someone configuring include_content=False to keep secrets out of their tracing backend had no reason to know a second flag existed, let alone that it defaulted the other way. Same script, same inputs, against pydantic-ai-slim==2.58.0: {"native_tools":[{"kind":"mcp_server","id":"internal-billing-mcp", "url":"[REDACTED]","authorization_token":"[REDACTED]", "headers":{"X-Tenant-Key":"[REDACTED]"}}], ...} The fix redacts the specific fields that carry credentials inside a native tool's config, independent of either flag. model_request_parameters still tells you a native MCP tool was in play; it no longer tells you what it would take to use it. Why this is worse than a logging bug Traces usually land somewhere with a different access model than your secret store: a shared observability platform, a third-party APM vendor, a teammate who has trace-viewer access but not secrets-manager access. None of those audiences is supposed to be able to read your MCP server's bearer token. Before 2.58.0, every traced call through a provider-native MCP connector handed it to all of them, in plaintext, in a system most people don't think of as a place secrets end up. If you're on an affected version (pydantic-ai-slim before 2.58.0, or before 1.107.8 on the 1.x line): upgrade, restrict access to historical traces in the meantime, and rotate any credential that ever passed through a provider-native MCP tool config while instrumented. The fix is a point upgrade, not a config change, which is exactly why include_content=False alone wasn't going to save you. The same release also patched GHSA-5pfm-2g3g-gh85: with non-empty server-side message_history and the default manage_system_prompt='server', Vercel AI and AG-UI adapters could execute an available tool with client-chosen arguments without an actual model request. I didn't reproduce that one; it needs a live UI adapter session rather than a single instrumented span, which is a different repo. It's the same release and the same lesson from a different angle: an agent framework's convenience defaults are worth re-reading every time they patch one. agentevals' OTel-native scoring ships eval results through the same kind of pipeline this post is about: an agent's run reduced to spans in a trace backend. That's exactly the surface worth auditing for what else ends up in those spans besides the thing you meant to measure. Try it git clone https://github.com/themsquared/pydantic-ai-mcp-telemetry-leak.git cd pydantic-ai-mcp-telemetry-leak ./scripts/demo.sh One script, two throwaway virtualenvs, no API key. If you're instrumenting any agent framework with OpenTelemetry and relying on a single "don't log content" flag, this is worth fifteen minutes: check whether your framework ships a second flag for tool and connector configuration, and whether it defaults the way you'd assume. Repo: themsquared/pydantic-ai-mcp-telemetry-leak. Frequently asked questions What is GHSA-xv4x-g8mx-ch56? A Medium-severity advisory in pydantic-ai: a provider-native MCP connection's server URL, authorization token, and custom header values could land in plaintext in an OpenTelemetry request-span attribute, even with include_content=False set. It affects pydantic-ai-slim before 2.58.0 on the 2.x line and before 1.107.8 on the 1.x line, and is fixed in both. Does include_content=False stop pydantic-ai from logging MCP credentials in OpenTelemetry traces? Not before 2.58.0. include_content=False correctly withholds prompt and tool-call content, but a provider-native MCP tool's config is recorded in a separate model_request_parameters span attribute, governed by its own flag (include_model_request_parameters, default True). Setting include_content=False alone left that attribute, and any credentials in it, untouched. What is provider-native MCP in pydantic-ai, and how is it different from MCPToolset? MCPToolset is pydantic-ai's own client: it connects to an MCP server directly and the server's URL and headers never leave your process. A provider-native MCPServerTool instead hands the server's URL, an authorization_token, and headers to the model provider (Anthropic, OpenAI Responses, xAI), which connects to the MCP server itself. That config travels as part of the request pydantic-ai builds, which is what pydantic-ai's own instrumentation layer then recorded in the trace span. How can I reproduce the pydantic-ai MCP telemetry leak myself? themsquared/pydantic-ai-mcp-telemetry-leak runs one script against two virtualenvs, pydantic-ai-slim 2.56.0 and 2.58.0, with no network calls and no API key. A 15-line stub Model declares support for MCPServerTool and returns a canned response; an in-memory OpenTelemetry exporter captures the resulting span so you can diff the model_request_parameters attribute between versions directly. --- *Canonical version, with machine-readable markdown at https://webofmike.com/pydantic-ai-mcp-telemetry-leak/index.md: webofmike.com

Monty runs AI Python code in a secure Rust Monty runs AI Python code in a secure Rust ​ Monty is a secure Python sandbox written in Rust, designed to safely execute code generated by AI agents. Built by the pydantic team and available on PyPI. Ideal for anyone building or researching AI agent systems that run Python code. ​ pydantic/monty ​ #AI #Opensource #PythonRust #AIAgents ​ Follow for daily open source drops 👇 [ar] مونتي يشغل كود بايثون الخاص بالذكاء الاصطناعي داخل بيئة رست آمنة مونتي يُشغّل أكواد الذكاء الاصطناعي المكتوبة بلغة بايثون ضمن بيئة رست آمنة. مونتي عبارة عن بيئة اختبار آمنة مكتوبة بلغة بايثون رست، مصممة لتنفيذ الأكواد التي تُنشئها أنظمة الذكاء الاصطناعي بأمان. طوّرها فريق بايدانتيك وهي متاحة على باي باي. مثالية لكل من يُطوّر أو يبحث في أنظمة الذكاء الاصطناعي التي تُشغّل أكواد بايثون. pydantic/monty #الذكاء_الاصطناعي #المصادر_المفتوحة #بايثون_رست #أنظمة_الذكاء_الاصطناعي تابعنا للحصول على تحديثات يومية للمصادر المفتوحة 👇 [bn] মন্টি একটি সুরক্ষিত রাস্ট পরিবেশে এআই পাইথন কোড চালায়। মন্টি একটি সুরক্ষিত রাস্ট-এ এআই পাইথন কোড চালায় মন্টি হলো রাস্ট-এ লেখা একটি সুরক্ষিত পাইথন স্যান্ডবক্স, যা এআই এজেন্টদের দ্বারা তৈরি কোড নিরাপদে চালানোর জন্য ডিজাইন করা হয়েছে। এটি পাইড্যান্টিক (pydantic) টিম দ্বারা নির্মিত এবং পাইপিআই (PyPI)-তে উপলব্ধ। যারা পাইথন কোড চালাতে পারে এমন এআই এজেন্ট সিস্টেম তৈরি বা গবেষণা করছেন, তাদের জন্য এটি আদর্শ। pydantic/monty #এআই #ওপেনসোর্স #পাইথনরাস্ট #এআইএজেন্টস প্রতিদিন নতুন ওপেন সোর্স পেতে ফলো করুন 👇 [de-DE] Monty führt KI-Python-Code sicher in Rust aus Monty führt KI-Python-Code in einer sicheren Rust-Umgebung aus Monty ist eine sichere Python-Sandbox, geschrieben in Rust, die speziell für die sichere Ausführung von Code entwickelt wurde, der von KI-Agenten generiert wird. Entwickelt vom pydantic-Team und verfügbar auf PyPI. Ideal für alle, die KI-Agentensysteme entwickeln oder erforschen, die Python-Code ausführen. pydantic/monty #KI #OpenSource #PythonRust #KIAgenten Folge uns für tägliche Open-Source-Neuigkeiten 👇 [es-US] Monty ejecuta código Python de IA en un entorno Rust seguro Monty ejecuta código Python para IA en un entorno Rust seguro. Monty es un entorno seguro para Python, escrito en Rust, diseñado para ejecutar de forma segura código generado por agentes de IA. Desarrollado por el equipo de Pydantic y disponible en PyPI. Ideal para quienes desarrollan o investigan sistemas de agentes de IA que ejecutan código Python. pydantic/monty #IA #CódigoAbierto #PythonRust #AgentesIA Síguenos para recibir actualizaciones diarias de código abierto 👇 [fr-FR] Monty exécute le code Python de l'IA dans un environnement Rust sécurisé Monty exécute du code Python d'IA dans un environnement Rust sécurisé. Monty est un bac à sable Python sécurisé, écrit en Rust, conçu pour exécuter en toute sécurité du code généré par des agents d'IA. Développé par l'équipe pydantic et disponible sur PyPI. Idéal pour tous ceux qui développent ou étudient des systèmes d'agents d'IA exécutant du code Python. pydantic/monty #IA #Opensource #PythonRust #AIAgents Suivez-nous pour découvrir chaque jour de nouveaux projets open source 👇 [hi] Monty सुरक्षित Rust में AI पायथन कोड चलाता है Monty एक सुरक्षित Rust में AI Python कोड चलाता है Monty एक सुरक्षित Python सैंडबॉक्स है जिसे Rust में लिखा गया है और इसे AI एजेंटों द्वारा जनरेट किए गए कोड को सुरक्षित रूप से निष्पादित करने के लिए डिज़ाइन किया गया है। इसे pydantic टीम द्वारा बनाया गया है और यह PyPI पर उपलब्ध है। यह उन सभी के लिए आदर्श है जो Python कोड चलाने वाले AI एजेंट सिस्टम का निर्माण या अनुसंधान कर रहे हैं। pydantic/monty #AI #Opensource #PythonRust #AIAgents रोजाना ओपन सोर्स अपडेट के लिए फॉलो करें 👇 [id] Monty menjalankan kode Python AI dalam Rust yang aman Monty menjalankan kode AI Python dalam lingkungan Rust yang aman Monty adalah sandbox Python yang aman yang ditulis dalam Rust, dirancang untuk mengeksekusi kode yang dihasilkan oleh agen AI dengan aman. Dibangun oleh tim pydantic dan tersedia di PyPI. Ideal untuk siapa pun yang membangun atau meneliti sistem agen AI yang menjalankan kode Python. pydantic/monty #AI #Opensource #PythonRust #AIAgents Ikuti untuk rilis open source harian 👇 [it] Monty esegue codice Python per l'IA in un ambiente Rust sicuro Monty esegue codice Python per l'IA in un ambiente sicuro Rust Monty è una sandbox Python sicura, scritta in Rust, progettata per eseguire in modo sicuro il codice generato da agenti di IA. Sviluppato dal team di pydantic e disponibile su PyPI. Ideale per chiunque stia creando o studiando sistemi di agenti di IA che eseguono codice Python. pydantic/monty #IA #Opensource #PythonRust #AIAgents Seguici per aggiornamenti quotidiani sui progetti open source 👇 [iw] מונטי מריץ קוד פייתון של בינה מלאכותית במערכת Rust מאובטחת מונטי מריץ קוד פייתון מבוסס בינה מלאכותית ב-Rust מאובטח מונטי הוא ארגז חול מאובטח של פייתון שנכתב ב-Rust, שנועד לבצע קוד בצורה בטוחה שנוצר על ידי סוכני בינה מלאכותית. נבנה על ידי צוות pydantic וזמין ב-PyPI. אידיאלי לכל מי שבונה או חוקר מערכות סוכני בינה מלאכותית המריצות קוד פייתון. pydantic/monty #AI #OpenSource #PythonRust #AIAgents עקבו אחר פרסומים יומיים של קוד פתוח 👇 [ja] Rust製で安全にAIのPythonコードを実行するMonty Montyは、安全なRust環境でAI Pythonコードを実行します。 Montyは、Rustで記述されたセキュアなPythonサンドボックスで、AIエージェントが生成したコードを安全に実行できるように設計されています。pydanticチームによって開発され、PyPIで公開されています。Pythonコードを実行するAIエージェントシステムを構築または研究している方に最適です。 pydantic/monty #AI #Opensource #PythonRust #AIAgents 毎日更新されるオープンソース情報はこちら👇 [ko] Monty가 안전한 Rust 환경에서 AI Python 코드를 실행하는 방법 Monty는 안전한 Rust 환경에서 AI Python 코드를 실행합니다. Monty는 AI 에이전트가 생성한 코드를 안전하게 실행하도록 설계된 Rust로 작성된 안전한 Python 샌드박스입니다. pydantic 팀에서 개발했으며 PyPI에서 사용할 수 있습니다. Python 코드를 실행하는 AI 에이전트 시스템을 구축하거나 연구하는 모든 사용자에게 이상적입니다. pydantic/monty #AI #오픈소스 #PythonRust #AIAgents 매일 새로운 오픈소스 소식을 받으려면 팔로우하세요 👇 [ml] മോണ്ടി ഒരു സുരക്ഷിത റസ്റ്റിൽ AI പൈത്തൺ കോഡ് പ്രവർത്തിപ്പിക്കുന്നു മോണ്ടി ഒരു സുരക്ഷിത റസ്റ്റിൽ AI പൈത്തൺ കോഡ് പ്രവർത്തിപ്പിക്കുന്നു ​ AI ഏജന്റുമാർ സൃഷ്ടിക്കുന്ന കോഡ് സുരക്ഷിതമായി നടപ്പിലാക്കുന്നതിനായി രൂപകൽപ്പന ചെയ്‌തിരിക്കുന്ന, റസ്റ്റിൽ എഴുതിയ ഒരു സുരക്ഷിത പൈത്തൺ സാൻഡ്‌ബോക്‌സാണ് മോണ്ടി. പൈഡാന്റിക് ടീം നിർമ്മിച്ചതും PyPI-യിൽ ലഭ്യമായതുമാണ്. പൈത്തൺ കോഡ് പ്രവർത്തിപ്പിക്കുന്ന AI ഏജന്റ് സിസ്റ്റങ്ങൾ നിർമ്മിക്കുന്നതിനോ ഗവേഷണം നടത്തുന്നതിനോ ഏതൊരാൾക്കും അനുയോജ്യം. ​ pydantic/monty ​ #AI #Opensource #PythonRust #AIagents ​ ദിവസേനയുള്ള ഓപ്പൺ സോഴ്‌സ് ഡ്രോപ്പുകൾക്കായി പിന്തുടരുക 👇 [nl-NL] Monty voert AI Python-code uit in een veilige Rust-omgeving. Monty voert AI Python-code uit in een veilige Rust-omgeving Monty is een veilige Python-sandbox, geschreven in Rust, ontworpen om code gegenereerd door AI-agenten veilig uit te voeren. Ontwikkeld door het pydantic-team en beschikbaar op PyPI. Ideaal voor iedereen die AI-agentsystemen bouwt of onderzoekt die Python-code uitvoeren. pydantic/monty #AI #Opensource #PythonRust #AIAgents Volg ons voor dagelijkse open source-updates 👇 [pl] Monty uruchamia kod AI Python w bezpiecznym środowisku Rust Monty uruchamia kod AI Python w bezpiecznym środowisku Rust Monty to bezpieczna piaskownica Pythona napisana w Rust, zaprojektowana do bezpiecznego wykonywania kodu generowanego przez agentów AI. Stworzona przez zespół pydantic i dostępna na PyPI. Idealna dla każdego, kto tworzy lub bada systemy agentów AI, które uruchamiają kod Pythona. pydantic/monty #AI #Opensource #PythonRust #AIAgents Obserwuj, aby być na bieżąco z codziennymi nowościami open source 👇 [pt-BR] Monty executa código Python de IA em um ambiente Rust seguro. Monty executa código Python de IA em um ambiente Rust seguro Monty é um ambiente seguro para execução de código Python gerado por agentes de IA, escrito em Rust. Desenvolvido pela equipe pydantic e disponível no PyPI. Ideal para quem desenvolve ou pesquisa sistemas de agentes de IA que executam código Python. pydantic/monty #IA #OpenSource #PythonRust #AgentesIA Siga para receber novidades diárias sobre código aberto 👇 [ru] Monty запускает AI Python-код в безопасной среде Rust Monty запускает код ИИ на Python в безопасном Rust Monty — это безопасная песочница Python, написанная на Rust, предназначенная для безопасного выполнения кода, генерируемого агентами ИИ. Создана командой pydantic и доступна на PyPI. Идеально подходит для всех, кто разрабатывает или исследует системы агентов ИИ, работающие с кодом Python. pydantic/monty #AI #Opensource #PythonRust #AIAgents Подписывайтесь на ежедневные обновления открытого исходного кода 👇 [ta] பாதுகாப்பான Rust-ல் AI பைதான் குறியீட்டை இயக்கும் Monti மான்டி, பாதுகாப்பான ரஸ்ட் மொழியில் AI பைதான் குறியீட்டை இயக்குகிறது மான்டி என்பது ரஸ்ட் மொழியில் எழுதப்பட்ட ஒரு பாதுகாப்பான பைதான் சாண்ட்பாக்ஸ் ஆகும். இது AI ஏஜென்ட்களால் உருவாக்கப்படும் குறியீட்டைப் பாதுகாப்பாக இயக்குவதற்காக வடிவமைக்கப்பட்டுள்ளது. இது பைடான்டிக் குழுவால் உருவாக்கப்பட்டு, PyPI-இல் கிடைக்கிறது. பைதான் குறியீட்டை இயக்கும் AI ஏஜென்ட் அமைப்புகளை உருவாக்கும் அல்லது ஆய்வு செய்யும் எவருக்கும் இது மிகவும் ஏற்றது. pydantic/monty #AI #Opensource #PythonRust #AIAgents தினசரி ஓப்பன் சோர்ஸ் வெளியீடுகளுக்குப் பின்தொடரவும் 👇 [te] సురక్షితమైన రస్ట్ (Rust)లో AI పైథాన్ కోడ్‌ను రన్ చేసే మాంటీ (Monty) మాంటీ ఒక సురక్షితమైన రస్ట్‌లో AI పైథాన్ కోడ్‌ను నడుపుతుంది మాంటీ అనేది రస్ట్‌లో వ్రాయబడిన ఒక సురక్షితమైన పైథాన్ శాండ్‌బాక్స్, ఇది AI ఏజెంట్ల ద్వారా రూపొందించబడిన కోడ్‌ను సురక్షితంగా అమలు చేయడానికి రూపొందించబడింది. దీనిని పైడాంటిక్ బృందం నిర్మించింది మరియు ఇది PyPIలో అందుబాటులో ఉంది. పైథాన్ కోడ్‌ను నడిపే AI ఏజెంట్ సిస్టమ్‌లను నిర్మించే లేదా పరిశోధించే ఎవరికైనా ఇది ఆదర్శవంతమైనది. pydantic/monty #AI #Opensource #PythonRust #AIAgents రోజువారీ ఓపెన్ సోర్స్ అప్‌డేట్‌ల కోసం ఫాలో అవ్వండి 👇 [uk] Monty запускає AI Python-код у безпечному середовищі Rust Monty запускає код Python на базі штучного інтелекту в безпечному середовищі Rust ​ Monty — це безпечна пісочниця Python, написана на Rust, призначена для безпечного виконання коду, згенерованого агентами штучного інтелекту. Розроблена командою pydantic та доступна на PyPI. Ідеально підходить для тих, хто створює або досліджує системи агентів штучного інтелекту, що запускають код Python. ​ pydantic/monty ​ #AI #Opensource #PythonRust #AIAgents ​ Підпишіться на щоденні оновлення з відкритим вихідним кодом 👇

Airflow × AI Pluginを試す 概要 いつの間にかAirflowでLLM・AI Agent向けのProviderがサポートされていたので、ClaudeCode × Airflowをいくつか試してみる。 事前準備 Airflow3.1をQuick Start通りにインストールし、standaloneで起動できるようにしておく。 standaloneにおいての実行で、forkされた子プロセスからHTTPS(claude)を呼ぶと不安定になるので、DAGの実行にはairflow dags test <dag名>を用いる。 Claude ConsoleでAPIを発行しておく。 試したことないが、ローカルLLMもサポートされている。(link) インストール provideインストール pip install 'apache-airflow-providers-common-ai[anthropic]' airflow connectionの追加 airflow connections add my_claude_conn \ --conn-type pydanticai \ --conn-password 'sk-ant-xxxxxxxx' \ --conn-extra '{"model": "anthropic:claude-haiku-5-5"}' localhost 試してみる @task.llm / LLMOperator airflow.apache.org 無難なプロンプトを投げるようなDecorator / Operator。 pydantic_aiにおいて、prompt返答の型安全性を実現し、pydantic_aiからauthropic-sdkを呼び出しClaudeへ接続している。 各種パラメータについて promptとsystem_promptがある。system_promptがagentに対するpromptであり、promptが具体的なタスクのprompt。 airflow.apache.org agent = self._create_agent(output_type=self.output_type, instructions=self.system_prompt) result = self._run_llm(context, agent, self.prompt, usage_limits=usage_limits) usage_limitsにおいて、tokenのlimitなどを設けることができる。 require_approvalにおいて、人手による承認を設けることができる。 実装例.おすすめの本を紹介してもらう データエンジニアとしてのおすすめの本を紹介してもらう実装を試す。 dag.py from datetime import timedelta from pydantic import BaseModel from airflow.providers.common.compat.sdk import dag, task @dag def my_pipeline(): class Book(BaseModel): title_english: str title_ja: str price: str class Books(BaseModel): books: list[Book] @task.llm( llm_conn_id="my_claude_conn", system_prompt="あなたはデータエンジニアのスペシャリストです", output_type=Books, allow_modifications=True, ) def recommend(topic: str): 以下のreturnがtask.llmに渡すpromptになる return f"{topic}として読むべき本を3冊おすすめしてください。" @task def show(result: dict): print("=== おすすめの本 ===") for i, book in enumerate(result["books"], start=1): print(f"{i}. {book['title_ja']}") print(f" 原題: {book['title_english']}") print(f" 価格: {book['price']}") show(recommend("データエンジニア")) my_pipeline() 実行した結果が以下です。@task.llmのoutput_typeに合った形(Books)でresult["books"]が返ってきていることがわかります。 === おすすめの本 === 1. データ指向アプリケーションデザイン 原題: Designing Data-Intensive Applications 価格: 約5,720円（税込） 2. データエンジニアリングの基礎 原題: Fundamentals of Data Engineering 価格: 約4,400円（税込） 3. データウェアハウス工具箱 原題: The Data Warehouse Toolkit 価格: 約6,600円（税込） 試しにrecommend関数に指定したpromptをoutput_typeに沿っていない形にして実行してみる。 ・・・ def recommend(topic: str): return "今日の天気は？" すると以下のようにエラーになる。あまりエラーが判りやすくはないですね。 2026-10-25T04:20:54.338091Z [error ] [DAG TEST] Error running task <TaskInstance: my_pipeline.recommend manual__2026-10-25T04:20:50.026474+00:00 [queued]> [airflow.sdk.definitions.dag] loc=dag.py:1419 Traceback (most recent call last): ・・・ File "/Users/srn221b/airflow/airflow_venv/lib/python3.12/site-packages/airflow/sdk/api/client.py", line 171, in get_json_error raise err airflow.sdk.api.client.ServerResponseError: Server returned error @task.agent / AgentOperator airflow.apache.org toolやskillなどを用いてLLMに考えてもらいながらtaskを実行するときに使えるDecorator / Operator。 claudeへの接続の仕方などは@task.llmと同様。 各種パラメータについて toolsetsにおいて、Database(SQLToolset)・AgentSkill（AgentSkillsToolset）など、LLMに答えてもらうにあたり利用したいtoolを設定できる。 capabilitiesにおいて、Thinking、WebSerachなどの能力を指定できる。 前回の結果を再利用する手段として3つがサポートされている。 durable cache_prompt message_history 目的 失敗したときのやり直しを安く、確実にする 同じ入力の送り直しを安くする 会話を次の実行に引き継ぐ 再利用する範囲 同じタスクインスタンスのリトライ間 1回の実行の中で繰り返すリクエスト間 別のタスク実行（別の DAG run など）の間 どこに保存されるか Airflow 側のジャーナル（state store か cache path） LLM プロバイダー側のキャッシュ XCom（キーは message_history） 再利用するときの動き 記録済みのステップはLLMもツールも呼ばずに結果を再生する LLMは毎回呼ぶ。入力トークンが割引されるだけ 過去の会話を前提にして、新しくLLMを呼ぶ コストへの効果 再生したステップは0（usage にも数えない） 入力トークン料金の一部が割引 減らない（履歴の分だけ入力が増える） 既定値 False True None（1回で終わる会話） ※表はAIが生成 実装例.サンプルデータの自動作成 今回以下のようなサンプルデータの自動生成と確認をしてくれる実装を試してみる。 seed_orders：ローカルDBに接続するためにSQLToolset、サンプルデータ作成時の注意点を考慮させるためにAgentSkillsToolsetを持たせます。 report：ローカルDBに接続するためにSQLToolset、slackに接続するためにHookToolset(SlackWebhookHook..)を持たせます。 また事前にpostgressへのconnectorをpostgres_default、slackへのconnectorをslack_webhook_defaultとして作成しておきます。 skills/seed-orders/SKILL.md --- name: seed-orders description: ケーキ屋の orders テーブルに初期データ(テスト用の注文)を投入するときの条件と手順。初期データの投入を頼まれたときに使う。 --- 初期データ投入の注意点 ・・・ dag.py from pathlib import Path from airflow.providers.common.ai.toolsets import HookToolset from airflow.providers.common.ai.toolsets.skills import AgentSkillsToolset from airflow.providers.common.ai.toolsets.sql import SQLToolset from airflow.providers.common.compat.sdk import dag, task from airflow.providers.common.sql.operators.sql import SQLExecuteQueryOperator from airflow.providers.slack.hooks.slack_webhook import SlackWebhookHook @dag(tags=["example"]) def example_agent_decorator(): create_orders = SQLExecuteQueryOperator( task_id="create_orders", conn_id="postgres_default", sql=[ "DROP TABLE IF EXISTS orders", """ CREATE TABLE orders ( id serial PRIMARY KEY, customer text, product text, category text, amount numeric(10, 2), created_at date ) """, ], ) @task.agent( llm_conn_id="my_claude_conn", system_prompt="あなたはデータエンジニアです。ツールを使ってデータベースを操作してください。", toolsets=[ SQLToolset( db_conn_id="postgres_default", allowed_tables=["orders"], allow_writes=True, ), AgentSkillsToolset( sources=[str(Path(file).parent / "skills")], exclude_tools={"run_skill_script"}, ), ], ) def seed_orders(): return "seed-orders スキルの手順に従って、orders テーブルに初期データを入れてください。" @task.agent( llm_conn_id="my_claude_conn", system_prompt="あなたはデータアナリストです。ツールを使って質問に答え、回答は日本語で書いてください。", toolsets=[ SQLToolset( db_conn_id="postgres_default", allowed_tables=["orders"], ), HookToolset( SlackWebhookHook(slack_webhook_conn_id="slack_webhook_default"), allowed_methods=["send_text"], tool_prefix="slack", ), ], ) def report(question: str): return ( "orders テーブルは、ケーキ屋の検証用に自動生成した注文データです。\n" "customer は顧客、product と category は買ったもの(ケーキ・焼き菓子・ドリンク)です。\n" f"このデータを使って、次の質問に答えてください: {question}\n" "Slack に1回だけ送ってください。送ったあと、送った内容をそのまま答えてください。" ) create_orders >> seed_orders() >> report("カテゴリ別の売上と、売れ筋の商品、売上が特に多かった月を教えてください。") example_agent_decorator() 実行してみると、途中でLLMがSQLを組み立てて考えてくれているログが見れる。 ・・・ 2026-10-25T05:58:42.234507Z [info ] ::group::Tool call: query [airflow.task.operators.airflow.providers.common.ai.decorators.agent._AgentDecoratedOperator] loc=logging.py:64 2026-10-25T05:58:42.243900Z [info ] Running statement: SELECT count(*) AS n, min(created_at) AS min_date, max(created_at) AS max_date, count(DISTINCT customer) AS customers, min(amount) AS min_amt, max(amount) AS max_amt, sum(CASE WHEN created_at BETWEEN DATE '2025-12-20' AND DATE '2025-12-25' THEN 1 ELSE 0 END) AS dec_rush_rows, sum(CASE WHEN amount % 50 <> 0 THEN 1 ELSE 0 END) AS non50_amounts FROM orders, parameters: None [airflow.task.hooks.airflow.providers.postgres.hooks.postgres.PostgresHook] loc=sql.py:896 ・・・ また完了するとDatabaseへデータの挿入が行われ、SlackへSummary Reportされていることが確認できる。 id | customer | product | category | amount | created_at -----+-------------+--------------------+----------+---------+------------ 1 | customer_3 | チョコレートケーキ | ケーキ | 650.00 | 2026-06-23 2 | customer_3 | マドレーヌ | 焼き菓子 | 150.00 | 2025-11-27 3 | customer_3 | 紅茶 | ドリンク | 550.00 | 2026-09-09 4 | customer_1 | コーヒー | ドリンク | 400.00 | 2026-07-23 5 | customer_7 | チーズケーキ | ケーキ | 500.00 | 2026-07-02 6 | customer_1 | ショートケーキ | ケーキ | 650.00 | 2025-12-21 ・・・ LLM Retry Policy と ClassifierRetryPolicy ! Airflow>=3.3.0が必要 Airflow3.3.0からRetry policiesというのができた。これを用いれば、LLMにタスクの失敗時のリトライ判断を委ねることができる。 種類としては、LLMRetryPolicyとClassifierRetryPolicyがサポートされ、いずれも以下のようにタスクのretry_policyに指定して使用する。 snowflake_policy = ClassifierRetryPolicy(・・・) ・・・ snowflake_policy = LLMRetryPolicy(・・・) ・・・ @task(retries=5, retry_policy=snowflake_policy) def query_snowflake(): ・・・ ではLLMRetryPolicyとClassifierRetryPolicyで何が異なるのかというと以下である。 LLMRetryPolicy 責務：モデルがRetryに関連するエラーの分類・動作をすべて決める。 ClassifierRetryPolicy 責務：モデルは分類だけ、動作はコードで定義した表で決める。 snowflake_policy = ClassifierRetryPolicy( ・・・ min_confidence=0.8, # categoriesの挙動を実行を決めるときの分類のmin確信度 categories={ Warehouseが停止したと分類したときの挙動 "warehouse_suspended": ErrorCategory( "The warehouse is suspended and will auto-resume.", delay=timedelta(seconds=30) ), tokenがexpiredしたと分類したときの挙動 "token_expired": ErrorCategory( "A JWT or session token expired; the token rotates on its own.", delay=timedelta(seconds=30) ) ・・・ またいずれもfallback_rulesでモデルが判断(分類)できなかったときのfallbackを設定できる。 実装例.モデルに再実行を委ねてみる rate limitエラーが出た場合と、bad dataエラーが出た場合に、モデルはどのように再実行を行うのかを試してみる。 from datetime import timedelta from airflow.providers.common.ai.policies.retry import LLMRetryPolicy from airflow.providers.common.compat.sdk import dag, task from airflow.sdk.definitions.retry_policy import RetryAction, RetryRule llm_policy = LLMRetryPolicy( llm_conn_id="my_claude_conn", timeout=30.0, fallback_rules=[ RetryRule(exception=ConnectionError, action=RetryAction.RETRY, retry_delay=timedelta(seconds=10)), RetryRule(exception=PermissionError, action=RetryAction.FAIL), ], ) @dag(catchup=False, tags=["sample", "retry_policy", "llm"]) def llm_retry_policy_sample(): @task(retries=3, retry_delay=timedelta(minutes=1), retry_policy=llm_policy) def rate_limited(): # rate limit エラー raise RuntimeError("429 Too Many Requests: Rate limit exceeded. Retry after 60 seconds.") @task(retries=3, retry_delay=timedelta(minutes=1), retry_policy=llm_policy) def bad_data(): # bad data エラー raise ValueError("Column 'user_id' expected type INT but got STRING in row 42.") rate_limited() bad_data() llm_retry_policy_sample() 実行してみると、rate limitエラーの方だけRetryが4回された。 人間としても、bad dataエラーの場合は再実行しても意味がない・rate limitエラーの場合は再実行したら直るかもと思うので、挙動としては正しいであろう。 ちなみに、LLMRetryPolicyにinstructionsが指定されていない場合、DEFAULT_INSTRUCTIONSが参照されるようだった。 そのほかにも そのほかにも以下がサポートされている。 @task.llm_branchを用いてLLM駆動型タスク分岐。 後続にA or Bのタスクがある場合、どちらを実行するかをLLMが決めてくれる。 @task.llm_sqlを用いて自然言語->sqlをbuildするタスクの作成。 sqlglotのAST解析を使って出力を検証している。 @task.llm_schema_compareを用いてDatabaseを横断したスキーマドリフト検出。 詳細は次のページを参照すれば確認できる。 airflow.apache.org どういった活用の仕方がされているか。 Airflow公式ブログ(link]では次のような活用の仕方が紹介がされている。 問い合わせチケットの振り分け（@task.llm_branch） レポートの要約と人による承認（@task.llm_file_analysis + enable_hitl_review=True） エージェントによるDB分析（@task.agent + SQLToolset）

Monty: Run Python, Choose What It Can Access Should AI-written Python get your normal access to files and the network? Pydantic's Monty runs a supported Python subset in a Rust interpreter, with host access supplied explicitly. In our original September test, a calculation returned 385 and a file read was denied. Those were two simple examples, not a security audit. Developers can configure memory, execution-time, and recursion limits. Host functions still need input checks, and Python compatibility matters. Project: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ar] Monty: شغّل Python واختر ما يمكنه الوصول إليه هل ينبغي منح شيفرة Python التي كتبها الذكاء الاصطناعي صلاحياتك المعتادة للوصول إلى الملفات والشبكة؟ يشغّل Monty من Pydantic مجموعة مدعومة من ميزات Python داخل مفسّر مكتوب بلغة Rust، مع منح الوصول إلى النظام المضيف صراحةً. في اختبارنا الأصلي في سبتمبر، أعادت عملية حسابية النتيجة 385، ورُفضت قراءة ملف. كانا مثالين بسيطين، لا تدقيقًا أمنيًا. يمكن للمطوّرين ضبط حدود للذاكرة ووقت التنفيذ والاستدعاء الذاتي. ولا تزال دوال النظام المضيف بحاجة إلى التحقق من المدخلات، كما أن التوافق مع Python مهم. المشروع: pydantic/monty #PydanticMonty #PythonSandbox #شيفرة_مولدة_بالذكاء_الاصطناعي #وكلاء_الذكاء_الاصطناعي #RustLang #HostFunctions #حدود_الموارد #مفتوح_المصدر [bn] Monty: পাইথন রান করুন, বেছে নিন এটি কী কী অ্যাক্সেস করতে পারবে এআই-লিখিত পাইথন কি আপনার ফাইল এবং নেটওয়ার্কে স্বাভাবিক অ্যাক্সেস পাওয়ার সুযোগ দেবে? পাইড্যান্টিকের মন্টি একটি রাস্ট ইন্টারপ্রেটারে সমর্থিত পাইথনের একটি উপসেট চালায়, যেখানে হোস্ট অ্যাক্সেস স্পষ্টভাবে সরবরাহ করা থাকে। আমাদের সেপ্টেম্বরের মূল পরীক্ষায়, একটি গণনার ফলে ৩৮৫ রিটার্ন এসেছিল এবং একটি ফাইল রিড করার অনুমতি প্রত্যাখ্যান করা হয়েছিল। এগুলো ছিল দুটি সাধারণ উদাহরণ, কোনো নিরাপত্তা নিরীক্ষা নয়। ডেভেলপাররা মেমরি, এক্সিকিউশন-টাইম এবং রিকার্সন লিমিট কনফিগার করতে পারেন। হোস্ট ফাংশনগুলোতে এখনও ইনপুট চেকের প্রয়োজন হয় এবং পাইথনের সাথে সামঞ্জস্যতা একটি গুরুত্বপূর্ণ বিষয়। প্রজেক্ট: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [de-DE] Monty: Python ausführen und Zugriffe selbst festlegen Soll von KI geschriebener Python-Code deine üblichen Zugriffsrechte auf Dateien und das Netzwerk erhalten? Monty von Pydantic führt eine unterstützte Teilmenge von Python in einem Rust-Interpreter aus. Zugriff auf das Hostsystem wird ausdrücklich eingeräumt. In unserem ursprünglichen Test im September ergab eine Berechnung 385, und ein Dateizugriff zum Lesen wurde verweigert. Das waren zwei einfache Beispiele, kein Sicherheitsaudit. Entwickler können Grenzen für Speicher, Ausführungszeit und Rekursion konfigurieren. Hostfunktionen brauchen weiterhin Eingabeprüfungen, und die Python-Kompatibilität ist wichtig. Projekt: pydantic/monty #PydanticMonty #PythonSandbox #KIGenerierterCode #KIAgenten #RustLang #HostFunctions #Ressourcenlimits #OpenSource [es] Monty: ejecuta Python y elige a qué puede acceder ¿Debería el código Python escrito por IA tener tu acceso habitual a los archivos y a la red? Monty, de Pydantic, ejecuta un subconjunto compatible de Python en un intérprete escrito en Rust, y el acceso al sistema anfitrión se concede explícitamente. En nuestra prueba original de septiembre, un cálculo devolvió 385 y se denegó una lectura de archivo. Fueron dos ejemplos sencillos, no una auditoría de seguridad. Los desarrolladores pueden configurar límites de memoria, tiempo de ejecución y recursión. Las funciones del sistema anfitrión siguen necesitando validación de entradas, y la compatibilidad con Python importa. Proyecto: pydantic/monty #PydanticMonty #PythonSandbox #CódigoGeneradoPorIA #AgentesIA #RustLang #HostFunctions #LímitesDeRecursos #CódigoAbierto [es-US] Monty: Ejecuta Python, elige a qué puede acceder ¿Debería el código Python escrito por IA tener el mismo acceso que tú a los archivos y la red? Monty de Pydantic ejecuta un subconjunto de Python compatible en un intérprete de Rust, con acceso al host especificado explícitamente. En nuestra prueba original de septiembre, un cálculo devolvió 385 y se denegó la lectura de un archivo. Estos fueron dos ejemplos sencillos, no una auditoría de seguridad. Los desarrolladores pueden configurar límites de memoria, tiempo de ejecución y recursión. Las funciones del host aún requieren comprobaciones de entrada, y la compatibilidad con Python es importante. Proyecto: pydantic/monty #PydanticMonty #PythonSandbox #CódigoEscritoPorIA #AgentesIA #RustLang #FuncionesDelHost #LímitesDeRecursos #CódigoAbierto [fr] Monty : exécutez Python, choisissez ses accès Le code Python écrit par une IA doit-il avoir vos accès habituels aux fichiers et au réseau ? Monty, de Pydantic, exécute un sous-ensemble pris en charge de Python dans un interpréteur écrit en Rust, avec des accès au système hôte accordés explicitement. Lors de notre test initial de septembre, un calcul a renvoyé 385 et une lecture de fichier a été refusée. Il s'agissait de deux exemples simples, pas d'un audit de sécurité. Les développeurs peuvent configurer des limites de mémoire, de durée d'exécution et de récursion. Les fonctions du système hôte nécessitent toujours une validation des entrées, et la compatibilité Python compte. Projet: pydantic/monty #PydanticMonty #PythonSandbox #CodeGénéréParIA #AgentsIA #RustLang #HostFunctions #LimitesDeRessources #OpenSource [fr-FR] Monty : Exécuter Python, choisir ses accès L'IA utilisant du Python devrait-elle bénéficier de votre accès habituel aux fichiers et au réseau ? Monty, de Pydantic, exécute un sous-ensemble de Python pris en charge dans un interpréteur Rust, avec un accès hôte explicitement fourni. Lors de notre test initial en septembre, un calcul a renvoyé 385 et la lecture d'un fichier a été refusée. Il s'agissait de deux exemples simples, et non d'un audit de sécurité. Les développeurs peuvent configurer les limites de mémoire, de temps d'exécution et de récursion. Les fonctions hôtes nécessitent toujours des vérifications d'entrée, et la compatibilité avec Python reste essentielle. Projet : pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [hi] Monty: पायथन चलाएँ, तय करें कि वह क्या एक्सेस कर सकता है क्या AI द्वारा लिखित Python को फ़ाइलों और नेटवर्क तक सामान्य पहुँच मिलनी चाहिए? Pydantic का Monty, Rust इंटरप्रेटर में समर्थित Python कोड के एक उपसमूह को चलाता है, जिसमें होस्ट एक्सेस स्पष्ट रूप से प्रदान किया जाता है। सितंबर में किए गए हमारे मूल परीक्षण में, एक गणना में 385 मान प्राप्त हुआ और फ़ाइल पढ़ने से इनकार कर दिया गया। ये दो सरल उदाहरण थे, सुरक्षा ऑडिट नहीं। डेवलपर मेमोरी, निष्पादन समय और रिकर्सन सीमाएँ कॉन्फ़िगर कर सकते हैं। होस्ट फ़ंक्शंस के लिए अभी भी इनपुट जाँच की आवश्यकता है, और Python संगतता महत्वपूर्ण है। प्रोजेक्ट: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [id] Monty: Jalankan Python, Pilih Apa yang Bisa Diaksesnya Apakah kode Python yang ditulis AI seharusnya mendapatkan akses normal ke file dan jaringan? Monty dari Pydantic menjalankan subset Python yang didukung dalam interpreter Rust, dengan akses host yang diberikan secara eksplisit. Dalam pengujian awal kami pada bulan September, sebuah perhitungan mengembalikan nilai 385 dan pembacaan file ditolak. Itu adalah dua contoh sederhana, bukan audit keamanan. Pengembang dapat mengkonfigurasi batasan memori, waktu eksekusi, dan rekursi. Fungsi host masih memerlukan pemeriksaan input, dan kompatibilitas Python penting. Proyek: pydantic/monty #PydanticMonty #PythonSandbox #KodeDitulisAI #AgenAI #BahasaRust #FungsiHost #BatasSumberDaya #SumberTerbuka [it] Monty: esegui Python, scegli cosa può accedere Il codice Python scritto dall'IA dovrebbe avere il normale accesso ai file e alla rete? Monty di Pydantic esegue un sottoinsieme di Python supportato in un interprete Rust, con accesso all'host fornito esplicitamente. Nel nostro test originale di settembre, un calcolo ha restituito 385 e la lettura di un file è stata negata. Questi erano due semplici esempi, non un audit di sicurezza. Gli sviluppatori possono configurare limiti di memoria, tempo di esecuzione e ricorsione. Le funzioni host necessitano comunque di controlli di input e la compatibilità con Python è importante. Progetto: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [iw] Monty: הרצת Python, בבחירת הרשאות הגישה האם פייתון שנכתב על ידי בינה מלאכותית צריך לקבל את הגישה הרגילה שלך לקבצים ולרשת? Monty של Pydantic מריץ תת-קבוצה נתמכת של פייתון במפרש Rust, כאשר גישת המארח מסופקת במפורש. במבחן המקורי שלנו מספטמבר, חישוב החזיר 385 וקריאת קובץ נדחתה. אלו היו שתי דוגמאות פשוטות, לא ביקורת אבטחה. מפתחים יכולים להגדיר מגבלות זיכרון, זמן ביצוע ורקורסיה. פונקציות מארח עדיין זקוקות לבדיקות קלט, ותאימות פייתון חשובה. פרויקט: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ja] Monty：Pythonを実行し、アクセス権を制御する AIが記述したPythonコードに、通常のファイルアクセスやネットワークアクセス権限を与えるべきでしょうか？PydanticのMontyは、サポートされているPythonサブセットをRustインタープリタ上で実行し、ホストアクセス権限を明示的に付与します。 9月に実施した最初のテストでは、計算結果が385となり、ファイル読み取りが拒否されました。これらは単純な例であり、セキュリティ監査ではありません。開発者は、メモリ、実行時間、再帰回数の制限を設定できます。ホスト関数には入力チェックが必要であり、Pythonとの互換性も重要です。 プロジェクト：pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ko] Monty: 파이썬 실행 및 접근 권한 제어 AI가 작성한 Python 코드가 파일과 네트워크에 정상적으로 접근하는 것이 허용되어야 할까요? Pydantic의 Monty는 지원되는 Python 기능들을 Rust 인터프리터에서 실행하며, 호스트 접근 권한은 명시적으로 제공됩니다. 지난 9월에 진행된 초기 테스트에서는 계산 결과값이 385였고 파일 읽기 요청은 거부되었습니다. 이는 단순한 예시일 뿐, 실제 보안 감사 상황은 아닙니다. 개발자는 메모리, 실행 시간, 재귀 호출 횟수 제한을 설정할 수 있습니다. 호스트 함수는 여전히 입력값 검사를 수행해야 하며, Python과의 호환성도 중요합니다. 프로젝트: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ml] Monty: പൈത്തൺ പ്രവർത്തിപ്പിക്കൂ, അത് എന്തിനൊക്കെ ആക്സസ് ചെയ്യണമെന്ന് തിരഞ്ഞെടുക്കൂ AI-ൽ എഴുതിയ പൈത്തണിന് ഫയലുകളിലേക്കും നെറ്റ്‌വർക്കിലേക്കും നിങ്ങളുടെ സാധാരണ ആക്‌സസ് ലഭിക്കണമോ? പൈഡാന്റിക്‌സിന്റെ മോണ്ടി, ഒരു റസ്റ്റ് ഇന്റർപ്രെറ്ററിൽ പിന്തുണയ്ക്കുന്ന ഒരു പൈത്തൺ ഉപസെറ്റ് പ്രവർത്തിപ്പിക്കുന്നു, ഹോസ്റ്റ് ആക്‌സസ് വ്യക്തമായി നൽകിയിട്ടുണ്ട്. ഞങ്ങളുടെ യഥാർത്ഥ സെപ്റ്റംബർ പരിശോധനയിൽ, ഒരു കണക്കുകൂട്ടൽ 385 നൽകി, ഒരു ഫയൽ റീഡ് നിരസിച്ചു. അവ രണ്ട് ലളിതമായ ഉദാഹരണങ്ങളായിരുന്നു, ഒരു സുരക്ഷാ ഓഡിറ്റല്ല. ഡെവലപ്പർമാർക്ക് മെമ്മറി, എക്സിക്യൂഷൻ-ടൈം, ആവർത്തന പരിധികൾ എന്നിവ കോൺഫിഗർ ചെയ്യാൻ കഴിയും. ഹോസ്റ്റ് ഫംഗ്ഷനുകൾക്ക് ഇപ്പോഴും ഇൻപുട്ട് പരിശോധനകൾ ആവശ്യമാണ്, കൂടാതെ പൈത്തൺ അനുയോജ്യതയും പ്രധാനമാണ്. പ്രോജക്റ്റ്: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [nl-NL] Monty: Python uitvoeren, kies waartoe het toegang heeft Zou door AI geschreven Python-code toegang moeten krijgen tot je normale bestanden en het netwerk? Pydantic's Monty voert een ondersteunde subset van Python uit in een Rust-interpreter, waarbij expliciet toegang tot de host wordt verleend. In onze oorspronkelijke test in september gaf een berekening een 385-foutcode terug en werd een bestandsleesbewerking geweigerd. Dit waren twee simpele voorbeelden, geen beveiligingsaudit. Ontwikkelaars kunnen geheugen-, uitvoerings- en recursielimieten configureren. Hostfuncties vereisen nog steeds inputcontroles en Python-compatibiliteit is belangrijk. Project: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [pa] Monty: ਪਾਈਥਨ ਚਲਾਓ, ਇਹ ਕੀ ਐਕਸੈਸ ਕਰ ਸਕਦਾ ਹੈ ਇਹ ਚੁਣੋ ਕੀ AI-ਲਿਖੇ Python ਨੂੰ ਫਾਈਲਾਂ ਅਤੇ ਨੈੱਟਵਰਕ ਤੱਕ ਤੁਹਾਡੀ ਆਮ ਪਹੁੰਚ ਮਿਲਣੀ ਚਾਹੀਦੀ ਹੈ? Pydantic ਦਾ Monty ਇੱਕ Rust ਇੰਟਰਪ੍ਰੇਟਰ ਵਿੱਚ ਇੱਕ ਸਮਰਥਿਤ Python ਸਬਸੈੱਟ ਚਲਾਉਂਦਾ ਹੈ, ਜਿਸ ਵਿੱਚ ਹੋਸਟ ਪਹੁੰਚ ਸਪੱਸ਼ਟ ਤੌਰ 'ਤੇ ਸਪਲਾਈ ਕੀਤੀ ਜਾਂਦੀ ਹੈ। ਸਾਡੇ ਅਸਲ ਸਤੰਬਰ ਟੈਸਟ ਵਿੱਚ, ਇੱਕ ਗਣਨਾ 385 ਵਾਪਸ ਆਈ ਅਤੇ ਇੱਕ ਫਾਈਲ ਰੀਡ ਨੂੰ ਇਨਕਾਰ ਕਰ ਦਿੱਤਾ ਗਿਆ। ਉਹ ਦੋ ਸਧਾਰਨ ਉਦਾਹਰਣਾਂ ਸਨ, ਸੁਰੱਖਿਆ ਆਡਿਟ ਨਹੀਂ। ਡਿਵੈਲਪਰ ਮੈਮੋਰੀ, ਐਗਜ਼ੀਕਿਊਸ਼ਨ-ਟਾਈਮ, ਅਤੇ ਰਿਕਰਜ਼ਨ ਸੀਮਾਵਾਂ ਨੂੰ ਕੌਂਫਿਗਰ ਕਰ ਸਕਦੇ ਹਨ। ਹੋਸਟ ਫੰਕਸ਼ਨਾਂ ਨੂੰ ਅਜੇ ਵੀ ਇਨਪੁਟ ਜਾਂਚਾਂ ਦੀ ਲੋੜ ਹੁੰਦੀ ਹੈ, ਅਤੇ Python ਅਨੁਕੂਲਤਾ ਮਾਇਨੇ ਰੱਖਦੀ ਹੈ। ਪ੍ਰੋਜੈਕਟ: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [pl] Monty: Uruchamiaj Pythona, decyduj do czego ma dostęp Czy Python napisany przez sztuczną inteligencję powinien uzyskać normalny dostęp do plików i sieci? Monty firmy Pydantic uruchamia obsługiwany podzbiór Pythona w interpreterze Rusta, z jawnie podanym dostępem do hosta. W naszym oryginalnym teście z września obliczenia zwróciły 385, a odczyt pliku został odrzucony. To były dwa proste przykłady, a nie audyt bezpieczeństwa. Programiści mogą konfigurować limity pamięci, czasu wykonywania i rekurencji. Funkcje hosta nadal wymagają kontroli danych wejściowych, a zgodność z Pythonem ma znaczenie. Projekt: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [pt-BR] Monty: execute Python e escolha o que ele pode acessar O código Python escrito por IA deve ter seu acesso habitual a arquivos e à rede? O Monty, da Pydantic, executa um subconjunto compatível de Python em um interpretador escrito em Rust, com acesso ao sistema hospedeiro concedido explicitamente. No nosso teste original de setembro, um cálculo retornou 385 e a leitura de um arquivo foi negada. Foram dois exemplos simples, não uma auditoria de segurança. Desenvolvedores podem configurar limites de memória, tempo de execução e recursão. As funções do sistema hospedeiro ainda precisam de validação das entradas, e a compatibilidade com Python importa. Projeto: pydantic/monty #PydanticMonty #PythonSandbox #CódigoGeradoPorIA #AgentesDeIA #RustLang #HostFunctions #LimitesDeRecursos #CódigoAberto [ru] Monty: запускайте Python и выбирайте, к чему дать доступ Стоит ли давать Python-коду, написанному ИИ, ваш обычный доступ к файлам и сети? Monty от Pydantic выполняет поддерживаемое подмножество Python в интерпретаторе на Rust, а доступ к хост-системе предоставляется явно. В нашем первоначальном сентябрьском тесте вычисление вернуло 385, а чтение файла было запрещено. Это были два простых примера, а не аудит безопасности. Разработчики могут настраивать ограничения памяти, времени выполнения и рекурсии. Функциям хост-системы по-прежнему нужна проверка входных данных, а совместимость с Python имеет значение. Проект: pydantic/monty #PydanticMonty #PythonSandbox #КодОтИИ #АгентыИИ #RustLang #HostFunctions #ОграниченияРесурсов #OpenSource [ta] Monty: பைத்தானை இயக்குங்கள், அது எதை அணுகலாம் என்பதை நீங்களே தீர்மானியுங்கள் செயற்கை நுண்ணறிவால் எழுதப்பட்ட பைத்தானுக்கு, கோப்புகள் மற்றும் நெட்வொர்க்கிற்கான உங்கள் இயல்பான அணுகல் கிடைக்க வேண்டுமா? பைடான்டிக்கின் மான்டி, ஆதரிக்கப்படும் பைத்தானின் ஒரு துணைத் தொகுப்பை ரஸ்ட் இன்டர்பிரெட்டரில் இயக்குகிறது, இதில் ஹோஸ்ட் அணுகல் வெளிப்படையாக வழங்கப்படுகிறது. எங்களின் அசல் செப்டம்பர் சோதனையில், ஒரு கணக்கீடு 385 என்ற மதிப்பைக் காட்டியது மற்றும் ஒரு கோப்பு வாசிப்பு மறுக்கப்பட்டது. அவை இரண்டு எளிய எடுத்துக்காட்டுகள், ஒரு பாதுகாப்புத் தணிக்கை அல்ல. டெவலப்பர்கள் நினைவகம், இயக்க நேரம் மற்றும் மீள்சுழற்சி வரம்புகளை உள்ளமைக்க முடியும். ஹோஸ்ட் செயல்பாடுகளுக்கு இன்னும் உள்ளீட்டுச் சோதனைகள் தேவை, மேலும் பைத்தான் இணக்கத்தன்மை முக்கியமானது. திட்டம்: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [te] Monty: పైథాన్ రన్ చేయండి, దేనికి అనుమతి ఉండాలో మీరే నిర్ణయించుకోండి AI-రచించిన పైథాన్, ఫైల్స్ మరియు నెట్‌వర్క్‌కు మీ సాధారణ యాక్సెస్‌ను అందించాలా? పైడాంటిక్ వారి మాంటీ, హోస్ట్ యాక్సెస్‌ను స్పష్టంగా అందిస్తూ, సపోర్ట్ ఉన్న పైథాన్ సబ్‌సెట్‌ను రస్ట్ ఇంటర్‌ప్రెటర్‌లో నడుపుతుంది. మా అసలు సెప్టెంబర్ పరీక్షలో, ఒక గణన 385ను తిరిగి ఇచ్చింది మరియు ఒక ఫైల్ రీడ్ నిరాకరించబడింది. అవి రెండు సాధారణ ఉదాహరణలు మాత్రమే, భద్రతా ఆడిట్ కాదు. డెవలపర్లు మెమరీ, ఎగ్జిక్యూషన్-టైమ్, మరియు రికర్షన్ పరిమితులను కాన్ఫిగర్ చేయవచ్చు. హోస్ట్ ఫంక్షన్లకు ఇప్పటికీ ఇన్‌పుట్ తనిఖీలు అవసరం, మరియు పైథాన్ అనుకూలత కూడా ముఖ్యమైనదే. ప్రాజెక్ట్: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [uk] Monty: запускайте Python, обирайте рівень доступу Чи повинен Python, написаний штучним інтелектом, отримати ваш звичайний доступ до файлів та мережі? Pydantic Monty запускає підтримувану підмножину Python в інтерпретаторі Rust, з явно заданим доступом до хоста. У нашому початковому вересневому тесті обчислення повернуло 385, а читання файлу було відмовлено. Це були два простих приклади, а не аудит безпеки. Розробники можуть налаштовувати обмеження пам'яті, часу виконання та рекурсії. Функції хоста все ще потребують перевірки вхідних даних, а сумісність з Python має значення. Проєкт: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource