Docker has fixed a high-severity flaw in Docker Sandboxes that could let an AI coding agent reach files on a developer's computer outside the folders it was allowed to use. The vulnerability, tracked as CVE-2026-103916 and rated 8.2 under CVSS 3.1, was fixed in version 0.51.0, released on 3 November 2026.

Docker Sandboxes runs AI coding agents such as Claude Code, Codex and Gemini CLI inside an isolated microVM, a lightweight virtual machine with its own kernel and filesystem. By design, an agent can only access files and folders the developer has explicitly approved, forming an allowlist that is supposed to be the only part of the machine the agent can reach.

The copy command that ignored the allowlist

Researcher Peyton Kennedy of Endor Labs found that the command used to copy files between the sandbox and the developer's computer, sbx cp, never checked that allowlist. The copy runs on the host side with the operator's full permissions, and the tool follows symbolic links in the paths it is given. An agent can therefore plant a shortcut inside its own approved workspace pointing somewhere else on the machine, and a later ordinary copy command will follow it.

The flaw works in both directions. A copy out of the sandbox can overwrite a host file, and a copy into the sandbox can pull a host file inside. In testing, the researcher showed the write reaching a file in a directory the sandbox had no grant for, and the read pulling a host file into the sandbox. The only limit found was that the target's parent folder had to already exist, which still leaves the operator's whole home folder exposed.

What was at risk

An agent that escaped in this way could gain access to sensitive files including cloud credentials and SSH keys. Overwriting files such as shell startup scripts, SSH authorised-keys files, Git configuration or Git hooks could turn the escape into code running on the host as the operator, although the researcher notes that escalation was reasoned through rather than demonstrated. An attacker could also steer an agent into planting the shortcut through prompt injection, using malicious instructions hidden in content the agent processes.

The command's only symlink control, the -L flag, guards just one of the four positions a shortcut can occupy, leaving three open. This is the second flaw of its kind in the tool this year: an earlier sbx cp escape, CVE-2026-17106, was fixed in version 0.38.0. Docker first planned a fix for 13 October in version 0.48.0, but that patch proved incomplete, and the finished fix arrived on 3 November in version 0.51.0.

What to do now

Anyone running Docker Sandboxes should upgrade to version 0.51.0. Until the update is installed, the researcher advises checking the resolved path of any copy destination with realpath before copying, and treating copies proposed by the agent itself with extra suspicion. The report describes a demonstrated escape in testing, not attacks seen in the wild. Full technical details are in the Endor Labs write-up and the SecQuill report.