Docker patched two critical vulnerabilities in Docker Sandboxes, the feature that runs each AI coding agent in its own isolated virtual machine, on September 7, 2026. The worse of the two, CVE-2026-77179 (CVSS 9.4), let malicious code inside a sandboxed VM on macOS escape its shared project folder and read or overwrite arbitrary files on the host machine. A second flaw, CVE-2026-79994 (CVSS 8.7), let a sandboxed guest hijack a host-side socket relay to reach resources outside its workspace. Both are fixed in Docker Sandboxes version 0.42.0.
How a Sandboxed AI Agent Could Break Out
Docker Sandboxes exists for exactly this kind of workload: point a coding agent like Claude Code or Codex at a project folder, and it runs inside a small microVM with only that folder shared in. The whole point of the isolation boundary is that a compromised or misdirected agent can’t touch the rest of your machine.
CVE-2026-77179 broke that boundary through the virtio-fs host server, the component that shares files between the guest VM and the host on macOS. According to Docker’s own security announcement, the host server reopened a file at a previously recorded path without rechecking whether that path still pointed inside the approved workspace. A malicious process running inside the guest could swap a parent directory for a symlink between the initial check and the reopen, then ride that symlink out of the shared folder to read or write files anywhere on the host as the VM manager process. Docker credits security researcher Oren Yomtov of accomplish.ai with finding it.
CVE-2026-79994 is a related time-of-check-to-time-of-use flaw in the guest-to-host Unix socket relay, letting a guest reach sockets outside its authorized workspace. It affects Docker Sandboxes versions 0.37.0 up to 0.42.0 and was reported by Jurre van Bergen of ThreatNotify.
What to Do About It
Docker hasn’t reported either flaw being exploited in the wild, but both were serious enough to ship as an out-of-band fix rather than wait for the next scheduled release. If your team runs Docker Sandboxes, update to version 0.42.0 or later now. Anyone using it to run AI coding agents against real client codebases, not throwaway test folders, should treat this as a hard requirement: the entire value of a sandbox is that a bug in the agent, or a bad instruction it gets tricked into following, doesn’t reach the rest of the filesystem. If you can’t update immediately, Docker recommends switching to clone mode instead of a live read-write mount, so a compromised sandbox only touches a disposable copy of the project.
It’s also a good prompt to check whatever isolation layer you’re relying on if you’ve built agent access into a client product, not just for coding assistants running on a laptop. Questions like this come up regularly in our AI development work, and projects in our AI development portfolio are a reminder that agent isolation is worth getting right the first time, not patching in after something goes wrong.
