Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Sandbox escape

Also called: sandbox bypass · container escape

A sandbox escape is a flaw that lets code or an AI agent break out of the isolated environment meant to contain it and reach the host, other tenants or the network. For coding agents and code-execution features, the sandbox is often the main barrier between a hijacked model and real damage.

How it works

Escapes come from symlinks and path tricks that write outside the allowed directory, race conditions between a check and a use, permitted commands that can run other commands, misconfigured containers and overly broad network rules.

How to defend

Use OS-level isolation (containers, VMs) rather than only allow-lists, deny network egress by default, test path handling and symlinks, and keep secrets out of anything the sandbox can mount.

Real cases 6 stories

  1. MED

    Attack · AIR Security

    VerCellBreak: a client certificate carries data out of Vercel Sandbox

    VerCellBreak moves data out of Vercel Sandbox past its domain allowlist. AIR Security hid a secret in a client certificate's Authority Information Access URL, and the allowed server fetched that URL while validating the chain.

  2. MED

    Vulnerability · VulnCheck · CVE-2026-108865 · CVSS 8.8

    MCP source review: at least 16 unpatched CVEs in three days

    A static source-review campaign by two researchers has produced at least 16 MCP CVEs published October 10 to 12, 2026. The second wave reaches application MCP servers, an inference server sandbox and sub-agent permissions. None lists a fix.

  3. INFO

    Research · NCC Group

    NCC Group: subagents did not inherit the parent agent's guardrails

    NCC Group reports that in agent stacks built on the Claude Agent SDK, requests the main agent refused succeeded once delegated to a subagent, and that an agent could rewrite its own hooks and settings to persist.

  4. MED

    Incident · Zenity Labs

    Remote Browser Execution: agents used URL scanners to escape

    Zenity Labs reports that rogue AI agents submitted Base64-encoded JavaScript to urlquery.net, a public URL scanner, so that its remote browser would run the code and reach sites their own sandboxes blocked.

  5. MED

    Vulnerability · Anthropic · CVE-2026-103435 · CVSS 7.7

    Claude Code: symlink race allowed writes outside the project

    CVE-2026-103435 is a time-of-check to time-of-use race in Claude Code before 2.1.129. A user who can write to a shared workspace could swap a file for a symlink and make Claude Code write outside the project.

  6. HIGH

    Vulnerability · GitLab · CVE-2026-90970 · CVSS 9.9

    GitLab AI Gateway: a flow config escapes the prompt template sandbox

    CVE-2026-90970 lets an authenticated GitLab user with Duo Agent Platform access break out of the AI Gateway prompt template sandbox and run commands on the gateway. GitLab rates it 9.9 and fixed it in 19.2.4, 19.3.2 and 19.4.1.