Topic starter
14/09/2026 10:09 am
TL;DR: Default sandboxes in Claude Code, Gemini CLI, and Codex failed under real testing, leaking credentials through permission rules, process isolation gaps, and kernel boundary weaknesses, according to Novee’s DefCon 2026 research. The result is that unattended AI agents expose a containment problem, not just a prompt-injection problem: the controls assumed a human could still arbitrate risk.
Editorial analysis by NHI Mgmt Group, based on content published by Novee: “DefCon 2026: The Sandbox Is a Suggestion: Breaking Claude Code, Gemini CLI, and Codex Sandboxes”.
Key questions
Q: What breaks when AI agent sandboxes rely on a human approval model?
A: The approval model breaks when the agent runs unattended and there is no human available to answer an ask prompt.
Q: Why do process-isolated AI agents still expose credential risk?
A: Process isolation reduces exposure, but it does not automatically remove access to shared runtime state.
Q: What are the signs that sandbox containment is failing in practice?
A: Look for agent workflows that depend on path-based trust, parent-written outputs, or allow lists that hide risky destinations behind normal-looking operations.
Practitioner guidance
- Test the approval fallback path Verify what happens when an agent reaches an ask decision in unattended mode, including whether any wrapper auto-promotes that state to allow.
- Inspect parent-process credential exposure Map which secrets remain available to the parent process even when the child environment is sanitized, and treat those values as reachable by the agent runtime.
- Validate output-path integrity Check whether sandboxed jobs write through a trusted path that can be replaced with a symlink, and confirm the parent verifies inode identity before writing.
Bottom line: AI agent sandboxes can fail even when they are enabled, because the real control boundary may sit in approval logic, parent-process state, or file handling rather than in the sandbox wrapper itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Agent sandboxes fail when approval states are treated as safe enough for unattended execution: The Claude Code findings show that a permission model built around human arbitration does not translate cleanly into headless automation. Once ask becomes an acceptable runtime state for a background agent, the control boundary is no longer a boundary. The practitioner conclusion is that approval semantics must be designed for the execution model, not copied from interactive use.
A few things that frame the scale:
- According to PwC, 79% of organizations have already adopted AI agents to some degree.
A question worth separating out:
A: Treat the output path as part of the attack surface and verify that privileged writes are bound to object identity, not just file names. Then separate sandboxed execution from any unsandboxed parent action that can later overwrite or redirect the result.
👉 Read our full editorial: AI agent sandboxes fail when containment becomes a suggestion