Docker Sandboxes copy flaw let an AI agent reach host files such as cloud keys and SSH keys

A symlink flaw in Docker Sandboxes, which runs AI coding agents in microVMs limited to folders the developer allowlists, let an agent inside the sandbox reach host files outside that allowlist, Endor Labs reported on November 3. Tracked as CVE-2026-103916 and rated 8.2 under CVSS 3.1, the bug is in the sbx cp command, which copies files between host and sandbox without consulting the allowlist and follows symlinks in parent path components; the -L flag guards only the last one. Because the agent controls its writable workspace, it can plant a symlink, and when the operator runs a copy the agent may have proposed, a read can land on files such as ~/.aws/credentials or ~/.ssh/id_ed25519, or a write on ~/.ssh/authorized_keys. Endor demonstrated only a canary file read. Docker fixed it in v0.51.0, after an incomplete fix in v0.48.0.

Why it matters

An agent sandbox exists mainly to keep the agent away from the developer's credentials, and a boundary holds only if every channel across it honors the same rules. Here the copy channel did not. The files named are the long-lived keys that make a developer laptop valuable: cloud access keys and SSH private keys, a non-human identity problem sitting in a home directory. It is the same target as the malicious extension that planted an SSH key last week.

Update sbx to v0.51.0 or later, and read the paths in any copy command an agent suggests before running it, since that suggestion is an agent instruction injection surface. The stronger fix is to keep long-lived cloud keys off developer machines and use short-lived credentials issued through SSO, so a file read yields little. Our guide to securing AI agent identities covers scoping agent access.

Source: Endor Labs