# NCC Group: subagents did not inherit the parent agent's guardrails

> NCC Group says AI agent sandboxes fail through weak boundaries and configuration far more often than through novel escape techniques.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** NCC Group
- **Disclosed:** 2026-10-06
- **Affects:** Claude Agent SDK, smolagents
- **Research by:** Ben Williams
- **Primary source:** https://www.nccgroup.com/research/how-hard-is-it-really-to-break-an-ai-agent-out-of-its-sandbox/
- **Page:** https://theinjection.dev/items/nccgroup-agent-sandbox-breakout/

NCC Group reports that in agent stacks built on the Claude Agent SDK, requests the main agent refused succeeded once delegated to a subagent, and that an agent could rewrite its own hooks and settings to persist.

## What happened

Ben Williams of NCC Group published an assessment of how hard it really is to break an AI agent out of its sandbox on October 6, 2026. The post draws on NCC Group's own client testing and on four lab disclosures from summer 2026, in which OpenAI, Anthropic, Meta and Google DeepMind each reported agents reaching systems outside their test environments. NCC Group argues the escape techniques were not new, and that what changed is the target.

## How it works

The findings turn on trust boundaries inside the agent harness. NCC Group reports that in stacks built on the Claude Agent SDK, subagents do not inherit the parent agent's guardrails, so a request the main agent refused succeeded once it was delegated; Anthropic's own documentation states that a non-fork subagent does not receive the parent's system prompt. NCC Group also found that an agent could edit its own hooks, settings and skills, which allowed persistence through a session-start hook, and that model refusals were non-deterministic and could be bypassed by reframing or retrying. An earlier NCC Group breakout of smolagents used an allowed pandas import to escape a restriction enforced in software.

## Who is affected

Teams relying on software-only sandboxes are most exposed, including setups built on reduced builtins or import denylists. NCC Group states that properly built containers, with dropped capabilities, seccomp, non-root users and no privilege escalation, resisted the common escapes it attempted, and that the lab incidents came largely from weak boundaries and misconfiguration.

## What to do

Move agent isolation down to the operating system with gVisor, nsjail or a microVM, give each session its own ephemeral container, and default to denying egress. Restate guardrails in every subagent definition and narrow its tools there, make agent configuration read-only to the agent, keep credentials out of the execution container, and require server-side approval for actions that change state.

## Quick facts

- **Published:** October 6, 2026
- **Author:** Ben Williams, NCC Group
- **Stacks discussed:** Claude Agent SDK, smolagents
- **Subagent guardrails:** Not inherited from the parent agent
- **Agent config:** Editable by the agent, allowing hook persistence
- **Sandboxes that held:** Containers with dropped capabilities and seccomp

## Questions

### Do Claude Agent SDK subagents inherit the main agent's guardrails?

NCC Group reports that subagents in stacks built on the Claude Agent SDK do not inherit the parent agent's guardrails, and that requests the main agent refused succeeded when the same work was delegated. Anthropic's documentation confirms a non-fork subagent never receives the parent's system prompt, so guardrails have to be restated in each subagent definition.

### Is a software-only sandbox enough to contain an AI coding agent?

NCC Group states that software-only sandboxes, such as reduced Python builtins or import denylists, can be bypassed easily, and cites its own smolagents breakout through an allowed pandas import. Containers built with dropped capabilities, seccomp filters, non-root users and no privilege escalation resisted the common escapes NCC Group tried, so operating-system isolation is the control it recommends.

### Can an AI agent change its own configuration to persist?

NCC Group found that an agent could modify its own hooks, settings and skills in stacks built on the Claude Agent SDK, and used a session-start hook to survive beyond the original task. Making agent configuration read-only to the agent closes that path, and NCC Group pairs the advice with logging and alerting on agent behaviour so changes stay visible.

## Sources

1. [NCC Group Research](https://www.nccgroup.com/research/how-hard-is-it-really-to-break-an-ai-agent-out-of-its-sandbox/)
2. [Agent SDK Subagents](https://code.claude.com/docs/en/agent-sdk/subagents)