marek-sm/canary is a research repository from Cal Poly CS and the AI Club that measures indirect prompt injection against LLM agents that use tools inside a sandbox. It has a structure that separates what the model proposes from what the system permits, and the November 7, 2026 commit 0e26ca5 merges PR #83 to block tools inside the sandbox from clearing their own death signal.
The background is that on Linux the tool process runs behind a seccomp filter and receives a termination signal via bwrap's --die-with-parent flag. Because the kernel can clear the signal set by bwrap when execing a new interpreter, tools/no_exec.py re-designates SIGKILL as the death signal. This change modifies that filter so that calls to prctl(PR_SET_PDEATHSIG) fail with EPERM, blocking the path in which a tool resets its own signal to 0 and thereby survives after bwrap dies or leaves behind child processes. docs/INTERFACES.md and the decision record docs/decisions/0023-tool-sandbox.md (revised on November 6, 2026) were updated as well.
Verification happens at two levels. tests/test_tool_sandbox.py interprets the cBPF filter, whose syscall numbers are written directly in the source, and checks that on prctl with the syscall numbers 157 on x86_64 and 167 on aarch64, EPERM occurs when the option is PR_SET_PDEATHSIG while other options pass through. tests/redteam/test_orphan.py adds a test that checks that even when a running tool attempts to clear its own death signal via ctypes, the signal stays at 9 (SIGKILL) and prctl returns -1 and EPERM (1); a case in which the signal is cleared was also added to the existing test that asserts no surviving children exist after a timeout.
That said, this change only takes effect on the Linux seccomp path. macOS is not affected by this problem because its profile only permits interpreter execution, and this commit presents no license, no separate numbers, and no indirect injection measurement results. It adds one more layer of defense that narrows the possibility of sandbox escape; it is not evidence that measurement performance has improved. Until the verification results are published, it is too early to treat it as a basis for real-world deployment.