Docker Sandboxes Escape Flaw Exposes macOS Hosts to Untrusted AI Agent Code

Docker disclosed and resolved a critical security vulnerability, tracked as CVE-2026-77179 (CVSS 9.4), affecting Docker Sandboxes on macOS. The flaw, present in versions 0.28.0 through 0.41.x and patched in version 0.42.0, originates in the macOS virtio-fs host server used to share project directories between the host and the virtualized guest. When reopening unlinked files based on previously stored paths, the server improperly resolved symbolic links. Consequently, malicious code running inside the sandbox—such as a prompt-injected AI agent or a malicious dependency—can swap a parent directory with a symlink, breaking out of the workspace to read or modify arbitrary files on the host with the permissions of the host virtual machine monitor user. Docker Sandboxes was built specifically to isolate AI coding agents and automated developer tasks while allowing targeted workspace sharing. In these workflows, agents are routinely granted high privileges (such as sudo access) inside the virtual machine under the assumption that the hypervisor boundary enforces complete containment. When the underlying host-guest filesystem boundary is breached, that containment guarantee fails. An attacker or malicious package executed by an agent can reach beyond the project folder into developer home directories, accessing SSH keys, cloud credentials, personal access tokens, and sensitive source code across the workstation. This incident highlights a major structural challenge in modern application security: the rapid operationalization of autonomous coding assistants and dynamic agent sandboxing. As organizations shift away from manual code review toward machine-speed software development, the developer workstation itself has become a high-priority initial access vector. Bridging host and guest filesystems via protocols like virtio-fs has historically presented severe time-of-check to time-of-use (TOCTOU) and symlink resolution risks. As automated agents gain more latitude to fetch, build, and test external dependencies, workspace boundary bugs represent a dangerous threat to local development environments. AppSec and engineering teams must ensure all macOS installations of Docker Sandboxes are immediately upgraded to version 0.42.0 or higher. In addition to patching, teams should limit the exposure of sensitive credentials on developer endpoints. Where feasible, organizations should configure sandboxes using clone mode rather than bidirectional read-write workspace mounts, or migrate agentic code execution pipelines entirely into ephemeral, isolated cloud development environments rather than running untrusted agents directly on local workstations.