Docker Sandboxes Flaws Let Malicious Agent Workloads Escape the Workspace and Reach macOS Host Files or Sockets

What happened

In controlled demonstrations, malicious code running inside an AI coding-agent sandbox replaced path components or socket paths after validation so the host-side service reopened resources outside the authorized workspace.

Why it matters

Potential read or modification of macOS host files with the account running the virtual machine, possible host code execution depending on the files reached, and access to capabilities exposed through Unix sockets outside the workspace. No in-the-wild exploitation was reported.

Missing authorization check

Object-bound validation at the final host open or connect operation, plus independent authorization before a compromised agent runtime uses protected credentials or performs consequential downstream mutations.

Would PP block it?

Malicious guest code may still cross the vulnerable local boundary and access ungated host resources. Where consequential actions are routed through Permission Protocol, the escaped workload must present a separately authenticated receipt bound to the exact action and signer before those actions execute.