Disclosed vulnerability
One Docker socket to rule them all: escaping the Codex, Cursor and Gemini CLI sandboxes through a privileged local daemon
AIR-2026-0168 AIR record · 2026-07-pillar-docker-socket-sandbox-escape
From the supporting source
A closed sandbox profile controls what the agent's own process can ask the kernel for. It does not control what a privileged local daemon will do on the agent's behalf.pillar.security
The record
Disclosed
2026-07-20
Vendor
OpenAI / Anysphere / Google
Product
OpenAI Codex CLI, Cursor, Gemini CLI
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — the agents escaped their sandboxes through the Docker socket
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Agent sandbox escape via privileged daemon
Impact type
Credential theft, Remote code execution, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
developers running these agents on machines with Docker Desktop
Capability abused
Defense & remediation
Recorded defense
seatbelt/sandbox profiles restricting the agent process
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
Cursor fixed (GHSA-v4xv-rqh3-w9mc, High); OpenAI marked informational, no CVE; Google deemed it documented behavior, no fix
Taxonomy & references
Curator notes
Pillar Security, Day 2 of the 'Week of Sandbox Escapes' series (2026-07-20). Reaches the home directory (SSH keys, credentials, browser data) and can modify shell rc files for persistence. The divergent vendor responses to the same finding are themselves notable.
Supporting sources
Cite as
Enkrypt AI. "One Docker socket to rule them all: escaping the Codex, Cursor and Gemini CLI sandboxes through a privileged local daemon". AIR, AIR-2026-0168. https://agentincident.vercel.app/i/AIR-2026-0168/ (accessed 2026-10-19).