Notifications
Clear all
Topic starter
28/07/2026 6:15 pm
TL;DR: A sandbox escape in Claude Cowork let an AI agent cross from a Linux VM into the host filesystem without prompts or alerts, exposing every SSH key and cloud credential within reach, according to Unosecur. The real failure is not isolation alone but the assumption that agent access can stay safely broad when execution moves at runtime speed.
NHIMG editorial — based on content published by Unosecur: July 27, 2026 SharedRoot: What a Sandbox Escape in Claude Cowork Says About Identity, Not Just Isolation
By the numbers:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when an AI agent has sandboxed execution but still inherits host credentials?
A: The control model breaks because isolation and identity scope are not the same thing.
Q: Why do AI agents complicate least-privilege design?
A: AI agents complicate least-privilege design because their tool use can change dynamically while the underlying permissions remain persistent.
Q: How do security teams know if an AI agent has too much access?
A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores.
Practitioner guidance
- Measure agent identity blast radius Inventory every AI agent session that can see local folders, cloud tokens, SSH keys, or shared mounts, then compare intended task scope to actual reachable resources.
- Separate agent sessions from endpoint credentials Move human and machine credentials out of the same operating context as the agent wherever possible, especially on developer laptops and local sandbox hosts.
- Tie tool use to a reviewable identity record Ensure every agent action is logged with the initiating identity, the connected tool, the scope in force, and the data touched.
What's in the full article
Unosecur's full blog post covers the operational detail this analysis intentionally leaves for the source:
- A breakdown of the SharedRoot chain and the specific local VM conditions that allowed the escape.
- Unosecur's description of the MCP Gateway controls for JIT access, least privilege, and tool-call logging.
- The access analyzer and DLP handling details that show how the gateway inspects MCP traffic for secrets and overprovisioning.
- The practical workflow for tying AI client actions back to the real human identity behind the session.
👉 Read Unosecur's analysis of the SharedRoot sandbox escape and agent trust model →
AI agent sandbox escapes: what identity teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
30/07/2026 10:53 pm
AI agent sandboxing is not an identity control. Isolation limits execution environment, but it does not define what the actor may reach if the boundary fails. SharedRoot shows why endpoint trust, mounted data, and credential presence must be treated as part of the same control surface. Practitioners should stop treating runtime containment as a substitute for entitlement design.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Who is accountable when an AI agent exposes credentials or changes identity state?
A: Accountability should sit with the business owner of the agent, the identity team that granted scope, and the control owner responsible for the affected workflow. If the agent touched privileged systems, incident handling should follow the same seriousness as any privileged access failure, because the issue is not just misuse but governance collapse across the identity layer.
👉 Read our full editorial: SharedRoot shows why AI agent identity is the real blast radius
