Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Default sandboxes in Claude Code, Gemini CLI, and Codex failed under real testing, leaking credentials through permission rules, process isolation gaps, and kernel boundary weaknesses, according to Novee’s DefCon 2026 research. The result is that unattended AI agents expose a containment problem, not just a prompt-injection problem: the controls assumed a human could still arbitrate risk.
NHIMG editorial — based on content published by Novee: DefCon 2026 research on breaking Claude Code, Gemini CLI, and Codex sandboxes
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope.
Questions worth separating out
Q: What breaks when AI agent sandboxes rely on a human approval model?
A: The approval model breaks when the agent runs unattended and there is no human available to answer an ask prompt.
Q: Why do process-isolated AI agents still expose credential risk?
A: Process isolation reduces exposure, but it does not automatically remove access to shared runtime state.
Q: How do security teams know if an AI agent sandbox is actually working?
A: A working sandbox should stop execution, block privilege expansion, and prevent the agent from touching sensitive context even when the model is manipulated.
Practitioner guidance
- Audit the harness as an access control layer Map which agent actions are governed by explicit deny rules, which collapse into broad allow behaviour, and which rely on a human review step that disappears in unattended execution.
- Separate parent authority from child execution Identify every path where the parent process, runner, or workflow controller still holds secrets or write privileges after sandbox startup, then treat those paths as part of the agent’s effective access boundary.
- Test output-handling for write-through abuse Check whether trusted files, workflow variables, or step summaries can be replaced, redirected, or reused so attacker-influenced bytes escape the sandbox through a privileged parent write.
What's in the full article
Novee's full research covers the operational detail this post intentionally leaves for the source:
- Exact code paths and permission checks that let ask collapse into allow in Claude Code.
- Step-by-step reproduction of the Gemini CLI process-isolation failure and its secret-exposure path.
- Codex sandbox escape mechanics, including the parent write-through behaviour and symlink abuse.
- Command-line examples and disclosure details for the two Claude CVEs and the Codex escape paths.
👉 Read Novee's research on breaking Claude Code, Gemini CLI, and Codex sandboxes →
AI agent sandboxes: what security teams need to test now?
Explore further
14/09/2026 10:10 am
Agent sandboxes are identity controls, not just runtime controls: The article shows that once an AI agent can act unattended, containment becomes part of identity governance, not merely application hardening. The effective question is who or what is authorised to touch secrets, write files, and trigger downstream actions when no human is present. Practitioners should treat the harness as an access enforcement layer, not a convenience wrapper.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, according to the AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: When should organisations treat AI agent containment as an IAM problem?
A: Treat it as an IAM problem whenever the agent can read secrets, write to trusted workflow paths, or invoke tools without direct human approval. At that point, the harness is making authorisation decisions on behalf of the organisation, so access scope, delegated authority, and offboarding matter as much as they do for service accounts and privileged users.
👉 Read our full editorial: AI agent sandboxes fail when containment becomes a suggestion
