AI agent sandbox escapes: what identity teams are missing

TL;DR: A sandbox escape in Claude Cowork let an AI agent cross from a Linux VM into the host filesystem without prompts or alerts, exposing every SSH key and cloud credential within reach, according to Unosecur. The real failure is not isolation alone but the assumption that agent access can stay safely broad when execution moves at runtime speed.

NHIMG editorial — based on content published by Unosecur: July 27, 2026 SharedRoot: What a Sandbox Escape in Claude Cowork Says About Identity, Not Just Isolation

By the numbers:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
• NHIs outnumber human identities by 25x to 50x in modern enterprises.
• Only 5.7% of organisations have full visibility into their service accounts.

Questions worth separating out

Q: What breaks when an AI agent has sandboxed execution but still inherits host credentials?

A: The control model breaks because isolation and identity scope are not the same thing.

Q: Why do AI agents complicate least-privilege design?

A: AI agents complicate least-privilege design because their tool use can change dynamically while the underlying permissions remain persistent.

Q: How do security teams know if an AI agent has too much access?

A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores.

Practitioner guidance

• Measure agent identity blast radius Inventory every AI agent session that can see local folders, cloud tokens, SSH keys, or shared mounts, then compare intended task scope to actual reachable resources.
• Separate agent sessions from endpoint credentials Move human and machine credentials out of the same operating context as the agent wherever possible, especially on developer laptops and local sandbox hosts.
• Tie tool use to a reviewable identity record Ensure every agent action is logged with the initiating identity, the connected tool, the scope in force, and the data touched.

What's in the full article

Unosecur's full blog post covers the operational detail this analysis intentionally leaves for the source:

• A breakdown of the SharedRoot chain and the specific local VM conditions that allowed the escape.
• Unosecur's description of the MCP Gateway controls for JIT access, least privilege, and tool-call logging.
• The access analyzer and DLP handling details that show how the gateway inspects MCP traffic for secrets and overprovisioning.
• The practical workflow for tying AI client actions back to the real human identity behind the session.

👉 Read Unosecur's analysis of the SharedRoot sandbox escape and agent trust model →

AI agent sandbox escapes: what identity teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →