What happened
Endor Labs reports a flaw in Docker Sandboxes, the tool that runs AI coding agents in isolated environments, which lets an agent get around its file access limits. Agents are meant to see only the host folders a developer approved, but the sbx cp command that moves files between sandbox and host ignores that list. An agent can place a symbolic link in its approved workspace, and a later copy then follows it to files outside the approved area.
According to Endor Labs, this could let an agent read host files such as cloud credentials and SSH keys, or overwrite files so that code runs outside the sandbox. The researcher notes that turning the write into code execution was reasoned about, not demonstrated. Each attack still needs the developer to run one copy command, and a successful copy out prints nothing. Endor Labs says an attacker could push an agent into this through prompt injection.
Docker first aimed to fix it in version 0.48.0 on 13 October, then found that patch incomplete. The complete fix shipped in version 0.51.0 on 3 November.
Timeline
Who is affected
Developers who run AI coding agents in Docker Sandboxes and move files with sbx cp.
How to check
- Before a copy to or from a workspace path, resolve the path yourself and make sure it ends up where you expect.
- Check every part of the path, not only the last one, because the link can sit anywhere in it.
What to do
- Upgrade Docker Sandboxes to version 0.51.0, which carries the fix.
- Until you have upgraded, treat sbx cp as if someone untrusted wrote the command.
- Copy to and from folders the sandbox has never had mounted, and be most wary of copies the agent suggests.
Sources
Changelog
- First published.