# Docker Sandboxes copy flaw let an AI agent reach host files such as cloud keys and SSH keys

Source: https://startwithidentity.com/blog/2026-11-03-docker-sandboxes-copy-flaw-let-an-ai-agent-reach-host-files-such-as-cloud-keys/
Last updated: 2026-11-03
License: content by Start with Identity. Cite the source URL.

---

A symlink flaw in Docker Sandboxes, which runs AI coding agents in microVMs limited to folders the developer allowlists, let an agent inside the sandbox reach host files outside that allowlist, [Endor Labs reported](https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916) on November 3. Tracked as CVE-2026-103916 and rated 8.2 under CVSS 3.1, the bug is in the `sbx cp` command, which copies files between host and sandbox without consulting the allowlist and follows symlinks in parent path components; the `-L` flag guards only the last one. Because the agent controls its writable workspace, it can plant a symlink, and when the operator runs a copy the agent may have proposed, a read can land on files such as `~/.aws/credentials` or `~/.ssh/id_ed25519`, or a write on `~/.ssh/authorized_keys`. Endor demonstrated only a canary file read. Docker fixed it in v0.51.0, after an incomplete fix in v0.48.0.

## Why it matters

An agent sandbox exists mainly to keep the agent away from the developer's credentials, and a boundary holds only if every channel across it honors the same rules. Here the copy channel did not. The files named are the long-lived keys that make a developer laptop valuable: cloud access keys and SSH private keys, a [non-human identity](https://startwithidentity.com/glossary/nhi/) problem sitting in a home directory. It is the same target as the [malicious extension that planted an SSH key](https://startwithidentity.com/blog/2026-10-29-malicious-claude-code-extension-on-cursor-marketplace-planted-an-attacker-ssh-key/) last week.

Update `sbx` to v0.51.0 or later, and read the paths in any copy command an agent suggests before running it, since that suggestion is an [agent instruction injection](https://startwithidentity.com/techniques/agent-instruction-injection/) surface. The stronger fix is to keep long-lived cloud keys off developer machines and use short-lived credentials issued through SSO, so a file read yields little. Our guide to [securing AI agent identities](https://startwithidentity.com/guides/machine-identity/securing-ai-agent-identities/) covers scoping agent access.

Source: [Endor Labs](https://www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916)