Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE

A critical security vulnerability (CVE-2026-103916) was identified in Docker Sandboxes, a technology designed to isolate AI coding agents within microVMs from the host developer system. The flaw lies within the `sbx cp` file copy command, which fails to enforce access restrictions governed by the allowlist when transferring files between the sandbox and the host. By exploiting symbolic links planted within an approved workspace, an agent can trick this function into accessing or overwriting arbitrary files on the developer’s computer, such as SSH keys or cloud credentials.
The risks are severe: gaining unauthorized read access to sensitive host data and achieving write access that could enable remote code execution by manipulating system configuration files (like `.zshrc` or `.ssh/authorizedkeys`). The vulnerability is insidious because it requires only one documented operator command, making detection difficult during normal agent workflows. While an initial fix was slated for October 2026, the final, corrected version was released later on November 3, 2026 (v0.51.0), prompting immediate user upgrade recommendations.

The vulnerability, CVE-2026-103916, concerns Docker Sandboxes' file copy command (`sbx cp`).
An attacker can exploit this weakness using a symbolic link within an approved sandbox workspace.
This flaw bypasses the existing access restrictions enforced by the allowlist for `sbx cp`.
The read primitive allows an agent to pull host files into the sandbox when symlinks are planted at parent directory components.
The write primitive enables overwriting arbitrary host files by planting a symlink inside the granted workspace during a copy-out operation.
An initial fix was scheduled for October 13, 2026 (version 0.48.0).
The confirmed, final fix was released on November 3, 2026 (version 0.51.0).
The sandbox operates inside a microVM, isolating the agent from the host kernel.
Exploitation relies on the CLI resolving symlinks on the host side without consulting the allowlist for all path components.

The narrative functions primarily as a high-stakes threat disclosure framed within vendor advisory content. The strength of the piece lies in its meticulous technical demonstration: it successfully proves that security models built upon declarative lists (the allowlist) are insufficient when an unconstrained, procedural primitive—file I/O via symlink resolution—is introduced outside those defined boundaries. This exposes a fundamental architectural tension in sandboxing and capability-based security design: the line between "unrestricted action within bounds" and "unsafe access across perceived bounds."
The core assumption being challenged is that system primitives meant to facilitate workflow (like file sharing) are inherently trustworthy because they are used as documented examples (`sbx cp --help`). The attacker leverages the cognitive shortcut of *trusting the established procedure*. This suggests that in complex, interconnected systems, security engineering must not just guard data flows into and out of a boundary (the virtio-fs share), but must rigorously police the transformation rules applied to paths when those flows occur.
The implications for autonomous agents are profound: they move beyond being mere automated tools guided by explicit instructions; if the execution channel is flawed, the agent's proposed "helpful" action can become an arbitrary execution pathway onto the host system's persistent state (e.g., modifying `~/.ssh/authorizedkeys`). The argument highlights a systemic risk in delegating operations to software that interprets symbolic references—a common feature of abstraction layers—without validating the ultimate reality of the target path against the security policy.
Patterns detected: ARC-0024 Ambiguity (The term "access restrictions" is ambiguously defined between filesystem mount and CLI operation)
Autonomy check: No autonomy signals.