Author: DigitalSpying Security Desk
Date: September 17, 2026
Executive Summary
In a critical security disclosure that exposes the foundational risks of delegating autonomous execution to artificial intelligence, Docker has issued security patches addressing two severe vulnerabilities in Docker Sandboxes for macOS. Cataloged as CVE-2026-77179 (rated Critical) and CVE-2026-79994, the flaws permit malicious or untrusted code running inside an isolated Docker Sandboxes virtual machine to escape its containment boundary and read, modify, or alter arbitrary files across the host macOS filesystem with the full privileges of the host user account.
Docker Sandboxes was specifically engineered to provide an isolated execution runtime for autonomous AI coding agents (such as Claude Code, Cursor, Aider, and custom LLM agent harnesses), allowing them to run shell commands, test scripts, and build code inside lightweight micro-VMs without endangering the developer's workstation. However, due to a severe path traversal and symlink validation vulnerability within the host-to-guest filesystem sharing mechanism, untrusted code executed by an AI agent can break free from the shared project directory (/run/sandbox/source) and interrogate the entire host machine—exfiltrating SSH private keys, AWS/cloud tokens, browser session databases, and configuration secrets. Docker has remediated the issues in Docker Sandboxes version 0.42.0, urging all developers deploying AI agent sandboxes to update immediately.
Deep-Dive Technical Analysis
1. Docker Sandboxes Architecture & The AI Isolation Model
To protect developer systems from malicious packages or unintended agent actions, Docker Sandboxes executes workloads inside a minimal Linux virtual machine managed by macOS’s native Hypervisor framework:
* The Shared Boundary: The host directory containing the project repository is shared into the guest VM at /run/sandbox/source. In normal operation, the guest VM should be strictly confined to this mount point, while all parent and neighboring directories on the host remain completely invisible.
* The AI Threat Surface: When a developer assigns an autonomous AI agent to refactor code, fix bugs, or install dependencies, the agent automatically executes terminal commands (such as npm install, pip install, or running test scripts). If the repository contains an untrusted open-source component, a malicious package, or an indirect prompt injection payload, that untrusted code runs directly within the sandbox.
* The Filesystem Bridge Failure (CWE-59 / CWE-22): In affected Docker Sandboxes versions on macOS (versions 0.28.0 through 0.41.0), the host-side daemon responsible for brokering file I/O between macOS and the VirtioFS/shared folder daemon failed to validate symbolic link resolution properly.
* The Escape Mechanism: An adversary or malicious script executing inside the sandbox can generate an arbitrary symbolic link or directory reparse point that references relative parent traversal paths (e.g., ../../../../../../Users/
+----------------------------------------------------------------------------------------------------+
| DOCKER SANDBOXES VM ESCAPE EXPLOIT FLOW |
|---|+----------------------------------------------------------------------------------------------------+
[Developer Prompts Autonomous AI Agent to Inspect Untrusted GitHub Repo]
|
| 1. AI Agent Clones Repo & Executes Build Script inside Sandbox VM
v
[Docker Sandboxes Guest Micro-VM (Isolated Linux)]
|
| 2. Malicious Script Drops Path-Traversal Symlink in /run/sandbox/source
| Symlink points to: ../../../../../../Users/developer/
v
[Host-to-Guest Filesystem Sharing Daemon (macOS Host)]
|
| 3. Resolves Symlink Without Enforcing Sandbox Root Boundary (CWE-59)
v
[Escapes Virtualization Sandbox -> Executes with Host User Privileges]
|
+---> Reads Host SSH Private Keys (~/.ssh/id_ed25519)
+---> Extracts Cloud Credentials (~/.aws/credentials)
+---> Interrogates Browser Session Cookies & Keychain
+---> Injects Malicious Persistence into ~/.zshrc / ~/.bash_profile
2. Real-World Attack Scenarios: From Prompt Injection to Host Takeover
The ability to escape the sandbox fundamentally breaks the safety guarantees modern developers rely on:
* Indirect Prompt Injection in Repositories: An attacker creates a pull request or publishes an open-source library containing an indirect prompt injection payload hidden within documentation or source comments. When an autonomous AI assistant analyzes the codebase, the prompt instructs the agent to create and read the malicious symlink.
* Trojanized Dependencies: A developer uses an AI agent to build a project containing a newly registered or typosquatted dependency. During npm postinstall or setup.py execution, the script immediately deploys the escape primitive, harvesting the developer's credentials before the developer even inspects the code.
* Full Credential Harvesting: Because the Docker Sandboxes daemon runs under the user's macOS context, the guest code can read any file the developer can access—including:
* ~/.ssh/id_rsa and ~/.ssh/known_hosts
* ~/.aws/credentials, ~/.config/gcloud/, and ~/.azure/
* macOS Keychain tokens and Chrome/Arc browser cookies.
* .env files located outside the immediate project directory.
3. Vulnerability Lifecycle & Specification Matrix
Vulnerability Metric
Technical Specification
Vulnerability Identifiers
CVE-2026-77179 (Primary Escape) & CVE-2026-79994
Severity Rating
Critical (CVSS 9.0+)
Affected Platform
Docker Sandboxes on macOS
Vulnerable Versions
Version 0.28.0 through 0.41.0
Remediated Version
Version 0.42.0 (Released September 7, 2026; Public Notice Sept 15-17)
Common Weakness
CWE-59: Improper Link Resolution Before File Access
Exploitation Context
Host-level account privileges of the user running the sandbox
Industry Impact: The Fragile Safety Net of AI Tooling
This vulnerability highlights an emerging architectural challenge in the era of agentic software development:
* The Illusion of Containment: Developers and security teams increasingly assume that wrapping AI agents inside containers or micro-VMs provides bulletproof isolation against rogue actions or malicious code.
* The Complexity of Shared Filesystem Bridges: Virtualization hypervisors are inherently hardened, but the integration layers—specifically real-time filesystem synchronization between host and guest—are extraordinarily complex and remain prone to classic path traversal, race conditions, and symlink substitution attacks.
Strategic Recommendations & Mitigations
1. Mandatory Docker Sandboxes Upgrade
* Upgrade Docker Sandboxes to version 0.42.0 or newer immediately.
* Ensure that underlying Docker Desktop installations are running the latest stable release.
2. Workspace Directory Hygiene
* Isolate Project Roots: Never run an AI coding agent or Docker Sandbox inside a high-level folder (such as the root of ~/Projects or your user home directory). Ensure sandboxes are strictly initiated inside isolated, dedicated subdirectories.
* Keep Secrets Out of Development Folders: Never leave .env files or plaintext credentials in untracked workspace files where agents can access them.
3. macOS Permission Restrictions
* Ensure macOS Transparency, Consent, and Control (TCC) permissions for Docker are strictly scoped. Do not grant Docker "Full Disk Access" unless strictly required by operational needs.
* Deploy host-level file integrity monitoring to detect anomalous access to ~/.ssh/ or ~/.aws/ by virtualization daemons.