Thinking Inside the Box
The engineering choices behind Accomplish’s agent sandbox
Ben GordonMember of Technical Staff
Thoughts on enterprise AI from the people building the boring parts: policy, routing, and control.
Escaping the Cloudflare sandbox
Our latest sandbox escape points to a broader pattern: isolation can fail in many ways.
Oren YomtovPrincipal Security Researcher
Guest to host: escaping Docker's hypervisor
A container gets full read/write access to the host filesystem with three lines of bash. CVE-2026-77179, fixed in Docker Desktop 4.88.0 and Sandboxes 0.42.0.
Oren YomtovPrincipal Security Researcher
Escaping the OpenAI Codex sandbox, twice
Two ways out. One lets a patch write anywhere on the disk with no prompt. The other gets unsandboxed command execution out of read-only, the strictest mode Codex has.
Oren YomtovPrincipal Security Researcher
Beltdown2: Escaping the Cursor CLI sandbox
An attacker-controlled workspace/project folder, containing a .git/ directory, can escape the Cursor CLI's macOS sandbox and run code on your Mac.
Or HiltchCTO
Beltdown: Escaping the Claude Code sandbox
An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user. You never get the permission prompt.
Oren YomtovPrincipal Security Researcher
SharedRoot: Escaping the Claude Cowork sandbox
Untrusted content in a Claude Cowork session can escape the VM it's sandboxed in and read and write files anywhere on your Mac.
Oren YomtovPrincipal Security Researcher