Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor Labs

Summary

Endor Labs researchers found a vulnerability (CVE-2026-103916) in Docker Sandboxes, the isolation tool for AI coding agents. The sbx cp copy command does not enforce the sandbox's approved folder restrictions, and an agent can use a symbolic link inside an approved workspace to reach files outside the sandbox, including cloud credentials and SSH keys. The flaw is rated High (CVSS 3.1 8.2, CVSS 4.0 7.3) and is classified as CWE-59.

Mitigation

Fixed in Docker Sandboxes v0.51.0, released November 3, 2026. Users should upgrade as soon as the update is available.

Topics

• AI agents

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoThe Devil is in the Context: Nine Dimensions of Prompt Injection AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)