Docker Sandboxes Escape Flaws Expose Host Files and Sockets to AI Coding Agents

Docker published security advisories detailing two vulnerabilities in Docker Sandboxes, headlined by a critical flaw (CVE-2026-77179, CVSS 9.4) and a high-severity flaw (CVE-2026-79994, CVSS 8.7). The critical issue in the macOS virtio-fs host server allows processes inside the microVM to follow symlinks when reopening unlinked files, escaping shared project workspaces to read or modify arbitrary host files under the host Virtual Machine Monitor (VMM) user account. The second issue exploits a race condition in the guest-to-host Unix domain socket forwarder, enabling sandboxed guests to pivot connections to unauthorized AF_UNIX sockets on the host. Both flaws affect installations prior to version 0.42.0. This development strikes at the heart of the emerging enterprise architecture for AI coding agents. Organizations increasingly deploy autonomous or semi-autonomous AI agents (running in 'YOLO' or automated modes) with sudo access inside isolated Docker microVMs, explicitly assuming that hypervisor boundaries and shared workspace constraints prevent rogue actions or prompt-injection payloads from touching the developer's broader machine. When shared filesystem servers and IPC relays fail to properly enforce path traversal boundaries, that defense-in-depth model breaks down completely, allowing malicious dependencies or injected commands to achieve full host-level compromise. This incident fits into the wider friction surrounding software supply chain security and agentic AI adoption. As developers offload routine code generation, environment setup, and dependency resolution to automated agents, the local developer workstation has become a primary attack surface. The rapid transition from simple container namespaces to lightweight microVM sandboxes was designed to address this exact risk; however, these CVEs highlight that guest-to-host bridge mechanisms—specifically virtio-fs mounts and socket forwarders—remain notoriously complex and fragile choke points across cross-platform virtual machine architectures. In practice, engineering leaders must immediately audit developer environments and enforce the update to Docker Sandboxes 0.42.0 or newer across macOS and desktop setups. Beyond applying the patch, teams operating autonomous agent frameworks should review whether workspaces require bi-directional volume mounts or can run under isolated clone modes. Platform teams should also restrict developer-side socket bindings, minimize host account privileges running local VMM daemons, and ensure endpoint detection agents actively monitor non-standard host file modifications originating from local virtualization processes.