Agno patches a sandbox escape in its shell-block setting

Agno's CodeMode has a setting called allow_shell=False, meant to stop agents from running arbitrary shell commands. On IPython 9.17, it didn't work.

The bug is in how Agno disabled the %%bash magic. IPython 9.17 registers script magics like %%bash lazily, then recreates them whenever something looks them up. Agno's containment code removed bash from the cell-magic table once, at setup. But the lookup that follows just rebuilds the entry, so the block silently stopped applying. A kernel explicitly configured to forbid shell access still executed %%bash.

Worse, loading a sibling magic like %%sh could re-register bash on its own, so even a deployment that patched around the first problem stayed exposed through a side door.

The fix, shipped in Agno 3.0.2, materializes the script-magic provider before touching it, then strips bash from both the lazy table and the live registry at the same time. That closes the path IPython was using to bring the magic back.

If you run Agno agents with CodeMode and depend on allow_shell=False as your actual containment boundary rather than a soft guardrail, this is a forced upgrade, not an optional one. Check which IPython version your agent sandboxes are pinned to. The release doesn't say how far back the lazy-registration behavior goes in IPython's version history, so don't assume anything before 9.17 is safe by default. It's also worth checking whether other magics beyond %%sh can re-trigger the same registration path, since the release notes only name that one.