Topic starter
14/09/2026 10:09 am
TL;DR: Three different AI agent containment designs leaked credentials under real testing, with Novee saying the failures came through permission rules, process isolation gaps and kernel boundary weaknesses. Sandbox wrappers need validation across approval logic, parent-process state and file paths before teams trust them as controls.
Editorial analysis by NHI Mgmt Group, based on content published by Novee: “DefCon 2026: The Sandbox Is a Suggestion: Breaking Claude Code, Gemini CLI, and Codex Sandboxes”.
Key questions
Q: Why do process-isolated AI agents still expose credential risk?
A: Process isolation reduces exposure, but it does not automatically remove access to shared runtime state.
Q: What are the signs that sandbox containment is failing in practice?
A: Look for agent workflows that depend on path-based trust, parent-written outputs, or allow lists that hide risky destinations behind normal-looking operations.
Q: What breaks when AI agent sandboxes rely on a human approval model?
A: The approval model breaks when the agent runs unattended and there is no human available to answer an ask prompt.
Practitioner guidance
- Test the approval fallback path Verify what happens when an agent reaches an ask decision in unattended mode, including whether any wrapper auto-promotes that state to allow.
- Inspect parent-process credential exposure Map which secrets remain available to the parent process even when the child environment is sanitized, and treat those values as reachable by the agent runtime.
- Validate output-path integrity Check whether sandboxed jobs write through a trusted path that can be replaced with a symlink, and confirm the parent verifies inode identity before writing.
Bottom line: AI agent sandboxes can fail even when they are enabled, because the real control boundary may sit in approval logic, parent-process state, or file handling rather than in the sandbox wrapper itself.
Glossary terms: Agent Sandbox, Containment Boundary, Approval State, Identity Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
14/09/2026 10:10 am
Agent sandboxes fail when approval states are treated as safe enough for unattended execution: The Claude Code findings show that a permission model built around human arbitration does not translate cleanly into headless automation. Once ask becomes an acceptable runtime state for a background agent, the control boundary is no longer a boundary. The practitioner conclusion is that approval semantics must be designed for the execution model, not copied from interactive use.
A few things that frame the scale:
- According to PwC, 79% of organizations have already adopted AI agents to some degree.
A question worth separating out:
A: Treat the output path as part of the attack surface and verify that privileged writes are bound to object identity, not just file names. Then separate sandboxed execution from any unsandboxed parent action that can later overwrite or redirect the result.
👉 Read our full editorial: AI agent sandboxes fail when containment becomes a suggestion
This post was modified 6 days ago by NHI Mgmt Group