{"record":{"id":"887805edce52c534","repo":"BerriAI/litellm","slug":"content-blocked-execution-request-detected","errorCode":null,"errorMessage":"Content blocked: execution request detected","messagePattern":"Content blocked: execution request detected","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/block_code_execution/block_code_execution.py","lineNumber":495,"sourceCode":"                should_raise = True\n            parts.append(text[last_end:start])\n            if effective_block:\n                parts.append(self.MASK_PLACEHOLDER)\n            else:\n                parts.append(text[start:end])\n            last_end = end\n\n        parts.append(text[last_end:])\n        new_text: Final = \"\".join(parts)\n        return new_text, should_raise\n\n    def _raise_block_error(self, language: str, is_output: bool, request_data: dict) -> None:\n        if language == \"execution_request\":\n            msg = \"Content blocked: execution request detected\"\n        else:\n            msg = f\"Content blocked: executable code block detected (language: {language})\"\n        if is_output:\n            raise HTTPException(\n                status_code=400,\n                detail={\n                    \"error\": msg,\n                    \"guardrail\": self.guardrail_name,\n                    \"language\": language,\n                },\n            )\n        self.raise_passthrough_exception(\n            violation_message=msg,\n            request_data=request_data,\n            detection_info={\"language\": language},\n        )\n\n    @log_guardrail_information\n    async def apply_guardrail(\n        self,\n        inputs: GenericGuardrailAPIInputs,\n        request_data: dict,","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/block_code_execution/block_code_execution.py#L477-L513","documentation":"The Block Code Execution guardrail detected execution intent in the scanned text (phrases like 'run this', 'execute this code' matched by the detect_execution_intent heuristics) with action=block, and blocked the call. On the input side this becomes a ModifyResponseException via raise_passthrough_exception, so the client gets an HTTP 200 whose body carries the violation message and the LLM is never called; on the output side (post-call hook) it is an HTTPException with status 400 and detail containing the guardrail name and language='execution_request'.","triggerScenarios":"A user prompt containing execution-intent phrases (and no conflicting no-execution phrases) while the guardrail is configured with action: block (the default) and detect_execution_intent enabled — the block fires even without a fenced code block when intent alone is detected. Also fires for tool outputs/responses when the model text matches intent patterns and is_output=True.","commonSituations":"Coding-assistant deployments where users legitimately ask to run code ('please execute this script') get blocked by default settings; teams enabling the guardrail without realizing detect_execution_intent blocks intent, not just code; output-side blocks surprising users because responses are always enforced regardless of intent.","solutions":["If execution requests should be allowed, set detect_execution_intent: false in the guardrail litellm_params so only fenced code blocks are considered.","Switch action: block to action: mask to redact the offending block/intent instead of rejecting the call.","If blocking is intended but you want a cleaner client experience, handle the 200-block / 400 response in your client (inspect the violation message) rather than treating it as an outage.","Tune blocked_languages / confidence_threshold so only the languages you actually prohibit are matched."],"exampleFix":"# before — blocks any request that looks like it wants code executed\nlitellm_params:\n  guardrail: block_code_execution\n  action: block\n  detect_execution_intent: true\n\n# after — only mask fenced code blocks, never reject on intent\nlitellm_params:\n  guardrail: block_code_execution\n  action: mask\n  detect_execution_intent: false","handlingStrategy":"try-catch","validationCode":"# No server-side pre-check exists; approximate client-side before sending\nimport re\nEXECUTION_INTENT = re.compile(r\"\\b(run|execute|eval)\\s+(this|the)\\s+(code|script|program)\\b\", re.I)\ndef likely_execution_request(text: str) -> bool:\n    return bool(EXECUTION_INTENT.search(text))\nif likely_execution_request(user_prompt) and guardrail_blocks_intent:\n    prompt = prompt.replace(\"run this\", \"show this\")  # or warn user","typeGuard":null,"tryCatchPattern":"from litellm.exceptions import HTTPException as LiteHTTPException\ntry:\n    resp = litellm.completion(..., guardrails=[\"block-code-exec\"])\nexcept LiteHTTPException as e:  # output-side block: HTTP 400\n    if \"execution request detected\" in str(e.detail if hasattr(e, \"detail\") else e):\n        return friendly_block_message(e)\n    raise\n# input-side block: HTTP 200 whose content is the violation message — check for it\nif \"Content blocked: execution request detected\" in resp_content:\n    return friendly_block_message(None)","preventionTips":["Set detect_execution_intent: false unless you truly want intent-only blocking — it fires with no code present.","Prefer action: mask during rollout; switch to block after measuring false-positive rates.","Log block events with the detection metadata to tune phrases/thresholds before enforcing.","Educate users that 'please run this' phrasing triggers the guardrail in block mode."],"tags":["litellm","guardrails","block-code-execution","content-moderation","prompt-blocking"],"backgroundTag":"guardrail-content-blocked","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}