Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security
As large language models (LLMs) increasingly integrate native code
interpreters, they enable powerful real-time execution capabilities,
substantially expanding their utility. However, such integrations introduce
potential system-level cybersecurity threats, fundamentally different from
prompt-based vulnerabilities. To systematically evaluate these
interpreter-specific risks, we propose CIRCLE (Code-Interpreter Resilience
Check for LLM Exploits), a simple benchmark comprising 1,260 prompts targeting
CPU, memory, and disk resource exhaustion. Each risk category includes
explicitly malicious ("direct") and plausibly benign ("indirect") prompt
variants. Our automated evaluation framework assesses not only whether LLMs
refuse or generates risky code, but also executes the generated code within the
interpreter environment to evaluate code correctness, simplifications made by
the LLM to make the code safe, or execution timeouts. Evaluating 7 commercially
available models from OpenAI and Google, we uncover significant and
inconsistent vulnerabilities. For instance, evaluations show substantial
disparities even within providers - OpenAI's o4-mini correctly refuses risky
requests at 7.1%, notably higher rates compared to GPT-4.1 at 0.5%. Results
particularly underscore that indirect, socially-engineered prompts
substantially weaken model defenses. This highlights an urgent need for
interpreter-specific cybersecurity benchmarks, dedicated mitigation tools
(e.g., guardrails), and clear industry standards to guide safe and responsible
deployment of LLM interpreter integrations. The benchmark dataset and
evaluation code are publicly released to foster further research.
6886cdce7d7a19a208cdf1d5
Gabriel Chua
claimed_verified
2025-07-28T08:44:38.078Z
655f4ff710e5c5fbef30fd97
https://cdn-avatars.huggingface.co/v1/production/uploads/655f4ff710e5c5fbef30fd97/bI_KQnFof50HRqYBWpyu2.jpeg
Gabriel C
user
gabrielchua
Running in CIRCLE? A Simple Benchmark for LLM Code Interpreter Security
As large language models (LLMs) increasingly integrate native code
interpreters, they enable powerful real-time execution capabilities,
substantially expanding their utility. However, such integrations introduce
potential system-level cybersecurity threats, fundamentally different from
prompt-based vulnerabilities. To systematically evaluate these
interpreter-specific risks, we propose CIRCLE (Code-Interpreter Resilience
Check for LLM Exploits), a simple benchmark comprising 1,260 prompts targeting
CPU, memory, and disk resource exhaustion. Each risk category includes
explicitly malicious ("direct") and plausibly benign ("indirect") prompt
variants. Our automated evaluation framework assesses not only whether LLMs
refuse or generates risky code, but also executes the generated code within the
interpreter environment to evaluate code correctness, simplifications made by
the LLM to make the code safe, or execution timeouts. Evaluating 7 commercially
available models from OpenAI and Google, we uncover significant and
inconsistent vulnerabilities. For instance, evaluations show substantial
disparities even within providers - OpenAI's o4-mini correctly refuses risky
requests at 7.1%, notably higher rates compared to GPT-4.1 at 0.5%. Results
particularly underscore that indirect, socially-engineered prompts
substantially weaken model defenses. This highlights an urgent need for
interpreter-specific cybersecurity benchmarks, dedicated mitigation tools
(e.g., guardrails), and clear industry standards to guide safe and responsible
deployment of LLM interpreter integrations. The benchmark dataset and
evaluation code are publicly released to foster further research.
CIRCLE evaluates interpreter-specific cybersecurity risks in large language models by testing their responses to prompts that target resource exhaustion, revealing significant vulnerabilities and the need for dedicated mitigation tools.
large language models code interpreters CIRCLE CPU memory disk resource exhaustion prompt-based vulnerabilities automated evaluation framework code correctness guardrails industry standards