Critical Docker Sandboxes Escape Vulnerabilities Patched to Protect AI Agent Workflows

Docker has issued security updates addressing two significant isolation bypass vulnerabilities in Docker Sandboxes, identified as CVE-2026-77179 (CVSS 9.4) and CVE-2026-79994 (CVSS 8.7). The high-severity flaw in macOS environments allowed a guest microVM to write arbitrary host files by exploiting a symlink fallback mechanism in the virtio-fs shared filesystem. Additionally, the Unix Domain Socket (UDS) forwarding layer contained a symlink race condition capable of reaching unauthorized host sockets. The remediations are officially available in Docker Sandboxes version 0.42.0. Why this matters: As development organizations adopt AI-assisted coding and autonomous software agents, Docker Sandboxes has become a key primitive for running generated or unverified code safely. When an agent operating inside an isolated VM can traverse host boundaries, the blast radius shifts immediately from an encapsulated test runner to the developer's local workstation, credentials, and broader enterprise network. Platform and DevSecOps teams relying on microVM isolation to sandbox agentic workflows must treat local containment tools with the same scrutiny applied to cloud multi-tenant runtimes. Contextual trend: The broader DevOps and cloud ecosystem is rapidly pivoting toward microVMs and lightweight hypervisors (such as Apple Virtualization Framework, Firecracker, and virtio-fs integrations) as standard defense-in-depth for AI workloads. However, shared-filesystem bridges remain the most common attack surface in modern container-to-host virtualization. As developer tooling transitions from standard OCI containers to nested microVMs for agent execution, boundary validation around virtual file sharing and socket proxies will remain a primary security focal point. Practitioner takeaway: Teams utilizing Docker Sandboxes should immediately upgrade installations to version 0.42.0 or later across all macOS and developer systems. Beyond updating, engineering leads should audit automated agent permissions, restrict host path mounts to strictly necessary directories, and enforce zero-trust network boundaries on local forwarders to mitigate future microVM escape vectors.