How to give CrewAI agents safe code execution

Runtime replaces CrewAI's retired code execution with a full Linux machine per crew. It costs $0.03125 an hour for 2 vCPU and 4 GiB while the agents work. CrewAI's docs now tell you to use a dedicated sandbox service for code execution. Runtime's four tools are typed Python functions, so CrewAI's own tool wraps them with no adapter. Every command runs in a Firecracker microVM with its own Linux kernel, where pip install works. crewai 1.15.30 was the current PyPI release on 25 October 2026. The tools ran in a crew's own loop with CrewAI 1.15 on 23 September 2026.

What changed in CrewAI

CrewAI's CodeInterpreterTool page, read on 25 October 2026, says the tool "has been removed from crewai-tools", and that "allow_code_execution and code_execution_mode parameters on Agent are also deprecated". In the 1.15.30 source, setting allow_code_execution logs that it "is deprecated and will be removed in v2.0".

The old tool had three modes. That is why it was removed:

Install

Terminalpip install -U crewai withruntimenpx withruntime login

The login opens a browser approval, so there is no Runtime key to paste. A deployed crew reads RUNTIME_API_KEY instead.

A crew with a sandbox

Pythonfrom crewai import Agent, Crew, Taskfrom crewai.tools import toolfrom withruntime import Sandboxfrom withruntime.tools import sandbox_toolsdef fix_tests() -> str:    with Sandbox.create() as sbx:        engineer = Agent(            role="Engineer",            goal="Make the test suite pass",            backstory="You work in a Linux sandbox.",            tools=[tool(f) for f in sandbox_tools(sbx)],        )        task = Task(description="Run the tests and fix what fails.", expected_output="A summary", agent=engineer)        return str(Crew(agents=[engineer], tasks=[task]).kickoff())print(fix_tests())

sandbox_tools is written without from __future__ import annotations, because CrewAI builds each tool's argument schema from real annotations. The engineer gets runtime_exec, runtime_read_file, runtime_write_file and runtime_list_files. Relative paths resolve under /workspace.

Several agents, one machine or many

Agents in a crew hand work to each other. A shared sandbox makes that literal: the analyst's CSV is on the reviewer's disk.

Pythonfrom crewai import Agent, Crew, Taskfrom crewai.tools import toolfrom withruntime import Sandboxfrom withruntime.tools import sandbox_toolswith Sandbox.create(timeout_seconds=1800) as sbx:    tools = [tool(f) for f in sandbox_tools(sbx)]    analyst = Agent(role="Analyst", goal="Produce clean numbers", backstory="Pandas expert.", tools=tools)    reviewer = Agent(role="Reviewer", goal="Check the numbers", backstory="Sceptical statistician.", tools=tools)    crew = Crew(        agents=[analyst, reviewer],        tasks=[            Task(description="Write /workspace/sales.csv with 12 months of sample data and a summary.",                 expected_output="The file path and a summary", agent=analyst),            Task(description="Recompute the summary from /workspace/sales.csv and list any differences.",                 expected_output="A verdict", agent=reviewer),        ],    )    print(crew.kickoff())

For agents that must not see each other's work, give each one its own sandbox. To start them all from one prepared machine, set it up once and call sbx.fork(count=3). That gives three running copies with the installed packages and memory. Each copy is billed as its own sandbox (images, volumes and snapshots).

What the crew can do in the sandbox

• Install and run anything that Ubuntu 24.04 runs. Python 3.12, Node.js 24, Bun, git and gcc are there, and sudo works.
• Start a service and share it. Your code calls sbx.previews.create(8501) to get a private HTTPS address for a Streamlit report (previews).
• Wait for a person with the machine parked. sbx.pause() keeps files, memory and processes while you have credit, and compute billing stops.
• Run notebook cells through sbx.interpreter.run(code). It keeps variables and returns charts as PNG, for a crew that reports with plots.

Keep keys and spending safe

• Model keys stay in the crew's process. The sandbox receives commands, not the LLM's credentials.
• max_total_cost_micros on Sandbox.create stops a sandbox once its total cost would exceed the limit. timeout_seconds with on_lease_end="stop" bounds the sandbox's life.
• A daily spending limit on the Runtime key caps a crew that loops. Past the limit, creates, wakes and extensions fail with spending_limit_reached, and nothing is charged (read-only keys and daily limits).
• A read-only key lets a monitoring job see every sandbox and its cost without being able to start one.
• Egress rules. Use network={"internet": False} for pure analysis, or an allow list of registries. The host enforces both (turn off sandbox internet).
• Secrets for a database or API that the crew's code calls reach the sandbox as a placeholder that is worthless on its own. The host adds the value on HTTPS requests to the hosts you name (secrets).

What it costs

Runtime bills measured CPU at $0.025 per vCPU-hour, with a floor of a twentieth of a vCPU, plus $0.0075 per reserved GiB-hour. A crew mostly waits on model calls, and with both CPUs busy 2 vCPU and 4 GiB is still $0.08 an hour (pricing). A new account gets 100 free hours of a 1 GB machine in its first 30 days, no card.

A crew that analyzes data is close to a data analysis agent. For why a microVM beats a local container for model-written code, see run untrusted LLM code.

Sources

Checked 25 October 2026.

• CrewAI CodeInterpreterTool: the removal notice, the deprecated Agent parameters, the three execution modes and their warnings
• crewai 1.15.30 on PyPI: the allow_code_execution deprecation message and the tool function that wraps a plain function

Facts on this page were checked on 25 October 2026.