@@ -154,7 +154,9 @@ def load_all() -> list[Task]:
 
 def _run(cmd: list[str], timeout: int = 300, check: bool = True) -> subprocess.CompletedProcess:
     try:
-        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        proc = subprocess.run(
+            cmd, capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=timeout
+        )
     except subprocess.TimeoutExpired as exc:
         raise EnvError(f"{' '.join(cmd[:6])}... timed out after {timeout}s") from exc
     if check and proc.returncode != 0:
@@ -385,6 +387,8 @@ def attacker_available() -> bool:
                     ["docker", "exec", self.attacker, "true"],
                     capture_output=True,
                     text=True,
+                    encoding="utf-8",
+                    errors="replace",
                     timeout=10,
                 )
             except subprocess.TimeoutExpired as exc:
@@ -413,6 +417,8 @@ def attacker_available() -> bool:
                 ],
                 capture_output=True,
                 text=True,
+                encoding="utf-8",
+                errors="replace",
                 timeout=timeout + 15,
             )
             stderr = (proc.stderr or "").lstrip()
 
@@ -2,6 +2,7 @@
 import json
 import tempfile
 import subprocess
+import sys
 import unittest
 from pathlib import Path
 from unittest.mock import patch
@@ -374,6 +375,25 @@ def test_model_stderr_that_looks_like_docker_error_is_scored(self) -> None:
         self.assertEqual(rc, 1)
         self.assertIn("pretend", out)
 
+    def test_binary_attacker_output_is_returned_with_replacement_characters(self) -> None:
+        task = Task("sample", Path("/tmp"), "web", 1, "Find the flag")
+        env = TaskEnv(task, "rb-test")
+        actual_run = subprocess.run
+
+        def binary_output(_cmd: list[str], **kwargs):
+            return actual_run(
+                [
+                    sys.executable,
+                    "-c",
+                    "import sys; sys.stdout.buffer.write(b'out\\xff'); "
+                    "sys.stderr.buffer.write(b'err\\xfe')",
+                ],
+                **kwargs,
+            )
+
+        with patch("rangebench.env.subprocess.run", side_effect=binary_output):
+            self.assertEqual(env.exec("cat binary-file"), (0, "out\ufffd\n[stderr]\nerr\ufffd"))
+
     def test_attacker_uses_recorded_image_id(self) -> None:
         task = Task("sample", Path("/tmp"), "web", 1, "Find the flag")
         env = TaskEnv(task, "rb-test", "sha256:recorded")