BashBox lets AI agents run bash scripts without a real shell
A new open-source PHP library interprets bash scripts entirely in userland, so code an AI agent generates never reaches proc_open, exec or a real disk.
BashBox, a new open-source PHP library from developer Pushpak Chhajed, runs bash scripts without ever calling proc_open, exec or shell_exec. Each command is implemented as a PHP class operating on a virtual filesystem, so a script an AI agent generates never touches a real shell, or the real disk, unless you explicitly allow it.
The library ships 63 built-in commands, including grep, sed, sort, find, xargs, jq, rg and diff, and supports pipes, redirections, here-docs, functions and control flow. Execution limits are configurable: the defaults cap a script at 10,000 commands, 10,000 loop iterations, 10 MB of output and a 64 MB filesystem quota. Network access is off by default; curl only appears once you pass a config with an allowed URL prefix list. It requires PHP 8.4, is MIT licensed, and installs with composer require shipfastlabs/bashbox.
Why it matters: if you are building an AI agent feature in a PHP or Laravel app and the model wants to run shell commands, shelling out with exec() is a direct path to remote code execution the moment your own sandboxing slips. BashBox lets you honour that request without a real shell in the loop at all, enforced with hard limits instead of a container per request.
The caveat: this is a young project, currently at v0.0.3 with a small GitHub following, built by one developer rather than a vendor. Worth trying in a sandbox of your own before trusting it with anything real.