diff --git a/services/zcode-agent/sandbox.mjs b/services/zcode-agent/sandbox.mjs
index e9d6ab756..230bce1d9 100644
--- a/services/zcode-agent/sandbox.mjs
+++ b/services/zcode-agent/sandbox.mjs
@@ -11,11 +11,11 @@ export async function sandboxCommand(options) {
     CANVAS_AGENT_RUN_TOKEN: token, NODE_OPTIONS: '--max-old-space-size=512' };
   if (platform === 'linux') {
     if (process.getuid?.() !== 0 || !Number.isSafeInteger(uid) || uid < 200000) throw new Error('Linux Agent 沙箱需要受控的独立运行 UID');
-    for (const file of ['/usr/bin/bwrap', '/usr/bin/setpriv', '/usr/bin/systemd-run'])
+    for (const file of ['/usr/bin/bwrap', '/usr/bin/setpriv', '/usr/bin/systemd-run', '/usr/bin/prlimit'])
       if (!existsSync(file)) throw new Error('缺少 Linux Agent 沙箱组件，禁止宿主直接执行');
     const args = ['--quiet', '--scope', '--collect', `--unit=yedir-canvas-${options.runId}`,
-      '--property=LimitCORE=0', '--property=MemoryMax=1073741824', '--property=TasksMax=128', '--property=CPUQuota=200%',
-      '/usr/bin/setpriv', `--reuid=${uid}`, `--regid=${uid}`, '--clear-groups',
+      '--property=MemoryMax=1073741824', '--property=TasksMax=128', '--property=CPUQuota=200%',
+      '/usr/bin/prlimit', '--core=0:0', '--', '/usr/bin/setpriv', `--reuid=${uid}`, `--regid=${uid}`, '--clear-groups',
       '/usr/bin/bwrap', '--unshare-all', '--new-session', '--die-with-parent', '--cap-drop', 'ALL', '--clearenv',
       '--ro-bind', '/usr', '/usr', '--ro-bind', '/lib64', '/lib64', '--symlink', 'usr/bin', '/bin', '--symlink', 'usr/lib', '/lib',
       '--ro-bind', runtimeDir, '/runtime', '--bind', home, '/home/agent', '--bind', workspace, '/workspace',