Executive Summary
In September 2026, Docker disclosed two critical vulnerabilities in Docker Sandboxes affecting macOS systems. CVE-2026-77179 (CVSS 9.4) allowed malicious code running inside AI coding agent virtual machines to escape sandbox restrictions and access or modify files anywhere on the host system with VMM user privileges. The flaw exploited a symlink-following vulnerability in the virtio-fs host server component. A second vulnerability, CVE-2026-79994 (CVSS 8.7), enabled unauthorized access to Unix domain sockets outside the authorized workspace. Both flaws were patched in version 0.42.0 released September 7, 2026.
This incident highlights the growing security risks in AI development environments as organizations increasingly adopt AI coding agents and automated development tools. The vulnerabilities expose critical gaps in container isolation and demonstrate how AI agents can be weaponized through prompt injection attacks to compromise host systems.
Why This Matters Now
AI coding agents are rapidly proliferating in enterprise development workflows, creating new attack surfaces where compromised AI tools can escape sandbox environments to access sensitive host systems and corporate data.
Attack Path Analysis
Malicious AI coding agent or compromised code exploits Docker Sandboxes CVE-2026-77179 to escape VM isolation through symlink manipulation in virtio-fs host server. Attacker gains host file system access with VMM user privileges, potentially establishing persistence and command channels. Limited lateral movement occurs within host boundaries before extracting sensitive project data and source code through compromised file access.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Malicious AI coding agent or prompt-injected code running inside Docker Sandboxes VM exploits CVE-2026-77179 symlink vulnerability in virtio-fs host server to escape sandbox isolation
Related CVEs
CVE-2026-77179
CVSS 9.4A critical file path traversal vulnerability in Docker Sandboxes virtio-fs host server allows malicious code in macOS virtual machines to escape the shared project directory and read or modify files anywhere on the host system.
Affected Products:
Docker Inc. Docker Sandboxes – 0.28.0 to 0.41.9
Exploit Status:
no public exploitCVE-2026-79994
CVSS 8.7A high severity vulnerability in Docker Sandboxes guest-to-host Unix socket relay allows malicious code to connect to unauthorized Unix domain sockets outside the workspace through symlink manipulation.
Affected Products:
Docker Inc. Docker Sandboxes – 0.37.0 to 0.41.9
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Escape to Host
Exploitation for Privilege Escalation
File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
Data from Local System
Data Manipulation: Stored Data Manipulation
Process Injection: Process Hollowing
File and Directory Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software vulnerability management processes
Control ID: 6.2.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – ICT risk management framework
Control ID: Article 8
CISA ZTMM 2.0 – Device Security
Control ID: Pillar 2
NIS2 Directive – Cybersecurity risk-management measures
Control ID: Article 21
ISO 27001:2022 – Management of technical vulnerabilities
Control ID: A.8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical Docker Sandboxes vulnerability enables AI coding agent sandbox escapes, compromising development environments and source code through symlink exploitation attacks.
Information Technology/IT
Virtualization security flaw allows malicious code to breach hypervisor boundaries, exposing IT infrastructure and requiring immediate container security policy updates.
Financial Services
Sandbox escape vulnerability threatens AI-assisted trading systems and automated financial processes, risking data exfiltration and regulatory compliance violations.
Health Care / Life Sciences
AI development platform vulnerability compromises healthcare coding environments, potentially exposing patient data and violating HIPAA encryption requirements.
Sources
- Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Fileshttps://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.htmlVerified
- Docker Sandboxes 0.42.0 Security Update - CVE-2026-77179 and CVE-2026-79994https://docs.docker.com/security/security-announcements/#docker-sandboxes-0420-security-update-cve-2026-77179-and-cve-2026-79994Verified
- Docker Sandboxes Release v0.42.0https://github.com/docker/sbx-releases/releases/tag/v0.42.0Verified
- CVE-2026-77179 Official CVE Recordhttps://github.com/CVEProject/cvelistV5/blob/main/cves/2026/77xxx/CVE-2026-77179.jsonVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain the Docker Sandboxes VM escape attack by limiting workload reachability and enforcing segmented access policies that reduce blast radius across the compromised development environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF workload isolation policies would likely constrain the VM escape by limiting container-to-host communication paths and reducing the attack surface exposed through virtio-fs interfaces
Control: Zero Trust Segmentation
Mitigation: Zero trust segmentation policies would likely limit the scope of host privilege escalation by constraining access to authorized file system boundaries and reducing the breadth of accessible host resources
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain Unix socket connections by enforcing segmented communication policies that limit inter-process access and reduce lateral movement pathways across host services
Control: Multicloud Visibility & Control
Mitigation: Comprehensive visibility controls would likely detect and constrain unauthorized communication channels by monitoring host-level network activity and limiting command channel establishment through policy-based restrictions
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely constrain data exfiltration by limiting outbound data transfer pathways and reducing the volume of sensitive information that could be transmitted through unauthorized channels
Despite CNSF protections, residual impact may still affect development assets within the compromised workspace, though the scope would likely be limited to segmented environment boundaries rather than broader infrastructure exposure
Impact at a Glance
Affected Business Functions
- AI Development Platforms
- Software Development Environments
- Code Execution Sandboxing
- Developer Productivity Tools
Estimated downtime: 1 days
Estimated loss: N/A
Potential access to host system files, source code repositories, development credentials, and any sensitive data stored on macOS systems running Docker Sandboxes. Risk of code execution on host systems with VMM user privileges.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies to contain AI agent workloads and prevent privilege escalation beyond intended boundaries
- • Deploy Multicloud Visibility & Control solutions to monitor anomalous interactions and suspicious automation behaviors from AI coding agents
- • Enable Egress Security & Policy Enforcement to prevent unauthorized data exfiltration from development environments and AI workspaces
- • Utilize Kubernetes Security (AKF) capabilities for pod-to-pod segmentation and namespace enforcement when containerizing AI agent workloads
- • Establish Threat Detection & Anomaly Response systems to baseline normal AI agent behavior and alert on potential prompt injection or compromise indicators
