diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py
index 6960310018..a5c193ff39 100644
--- a/studio/backend/core/inference/tools.py
+++ b/studio/backend/core/inference/tools.py
@@ -2545,14 +2545,24 @@ def _python_exec(
                         pass
     try:
         fd, tmp_path = tempfile.mkstemp(suffix = ".py", prefix = "studio_exec_", dir = workdir)
-        with os.fdopen(fd, "w") as f:
+        # utf-8 so non-ASCII in model-written code survives the OS default codec
+        # (Windows cp1252 would otherwise raise UnicodeEncodeError).
+        with os.fdopen(fd, "w", encoding = "utf-8") as f:
             f.write(code)
 
         safe_env = _build_bypass_env(workdir) if disable_sandbox else _build_safe_env(workdir)
+        if disable_sandbox:
+            # Match the sandboxed Python path without changing bypass shell I/O.
+            safe_env = dict(safe_env)
+            safe_env["PYTHONIOENCODING"] = "utf-8"
         popen_kwargs = dict(
             stdout = subprocess.PIPE,
             stderr = subprocess.STDOUT,
             text = True,
+            # Decode child output as utf-8 (it emits utf-8 via PYTHONIOENCODING);
+            # replace so non-ASCII output never crashes the read on Windows.
+            encoding = "utf-8",
+            errors = "replace",
             cwd = workdir,
             env = safe_env,
         )
diff --git a/studio/backend/tests/test_bypass_permissions.py b/studio/backend/tests/test_bypass_permissions.py
index 563f146816..d92509a5fe 100644
--- a/studio/backend/tests/test_bypass_permissions.py
+++ b/studio/backend/tests/test_bypass_permissions.py
@@ -135,6 +135,7 @@ def test_python_bypass_uses_bypass_preexec_and_bypass_env(captured_popen, monkey
     assert captured_popen["kwargs"]["preexec_fn"] is tools._bypass_preexec
     env = captured_popen["kwargs"]["env"]
     assert env.get("HOSTVAR") == "benign-xyz"
+    assert env.get("PYTHONIOENCODING") == "utf-8"
     assert "HF_TOKEN" not in env
 
 
@@ -151,9 +152,12 @@ def test_bash_blocklist_skipped_when_bypassed(captured_popen):
 
 
 @_POSIX_ONLY
-def test_bash_bypass_uses_bypass_preexec(captured_popen):
+def test_bash_bypass_uses_bypass_preexec(captured_popen, monkeypatch):
+    # bypass inherits benign host vars; clear so we assert _bash_exec adds none.
+    monkeypatch.delenv("PYTHONIOENCODING", raising = False)
     _bash_exec("echo hi", None, 5, "t", disable_sandbox = True)
     assert captured_popen["kwargs"]["preexec_fn"] is tools._bypass_preexec
+    assert "PYTHONIOENCODING" not in captured_popen["kwargs"]["env"]
 
 
 # ── real end-to-end python execution under bypass ───────────────────
diff --git a/studio/backend/tests/test_exec_utf8.py b/studio/backend/tests/test_exec_utf8.py
new file mode 100644
index 0000000000..90b78754ed
--- /dev/null
+++ b/studio/backend/tests/test_exec_utf8.py
@@ -0,0 +1,33 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved.
+
+"""_python_exec must round-trip non-ASCII output end to end.
+
+Model-written code routinely contains non-ASCII (arrows, CJK, emoji). The temp
+script and the child's stdout pipe both have to be UTF-8 or it crashes/garbles
+on Windows, whose default codec is cp1252. Mirrors the report in
+unslothai/unsloth#6489. The child is ``python`` with PYTHONIOENCODING=utf-8, so
+it emits UTF-8 on every OS; this proves the round-trip on a UTF-8 host and
+guards against a regression to the OS default codec.
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+_BACKEND_ROOT = Path(__file__).resolve().parents[1]
+if str(_BACKEND_ROOT) not in sys.path:
+    sys.path.insert(0, str(_BACKEND_ROOT))
+
+from core.inference.tools import _python_exec
+
+# Arrow, em-dash, accent, CJK, check mark, astral-plane emoji -- none encodable
+# in cp1252, so the OS default codec would raise on write or read.
+_UNICODE = "café — 数字 → ✓ 😀"
+
+
+@pytest.mark.parametrize("disable_sandbox", [False, True])
+def test_python_exec_round_trips_non_ascii(disable_sandbox):
+    out = _python_exec(f"print({_UNICODE!r})", disable_sandbox = disable_sandbox)
+    assert _UNICODE in out, repr(out)