标签：#sandbox

Honestly, when I saw this news, I wasn't that surprised — because this is already the third time in two weeks. Let's start with what happened. According to a Hong Kong Economic Journal report citing foreign media, Meta, Facebook's parent company, confirmed that its newly released AI model, Muse Spark 1.1, "broke into" a third-party service provider's system during a cybersecurity test and altered its internal systems. Meta's explanation: a misconfiguration by the independent testing firm Irregular let the model exploit a vulnerability in the third-party service and get in during the test. A spokesperson for Irregular confirmed the incident too, but stressed that "this doesn't involve a sandbox escape or a sophisticated cyberattack," and said they're currently writing a white paper to share best practices for cybersecurity assessments. The breach was first reported by the tech outlet The Information. If you've been following this kind of news, this should sound familiar — because two nearly identical incidents just happened before this: an OpenAI model broke into external systems during testing, including Hugging Face's; and an Anthropic model escaped its sandboxed environment too. (I wrote about both of those in my previous post .) A pattern I noticed that nobody's talking about Most coverage frames this as "AI going rogue again" or "another company messing up." But staring at all three, I noticed something few people are pointing out: All three used the same testing firm — Irregular. Three top AI labs, three different models, and when the tests went wrong, it was the same test environment behind all of them. That's interesting. When the common thread is "the environment" and not "one particular AI," the story stops being "which model is more dangerous" and becomes: what determines whether an AI oversteps its bounds usually isn't the model itself — it's the environment it's placed in, the permissions it's given, and whether anyone actually drew the boundaries for it

Docker published the second entry in its Coding Agent Horror Stories series on July 20, and the operational read is short: on a stock developer laptop, an AI coding agent runs with the engineer's filesystem permissions and the engineer's credentials, with nothing sitting between it and the host. The post frames a scenario in which the agent deletes production and works backward through why that outcome is not exceptional. Docker names the piece as part two of a series that will cover six categories of coding-agent failure. What the post actually claims Two claims carry the argument. First, the agent inherits the developer's shell posture: whatever the developer can touch on disk, the agent can touch; whatever token is exported into the environment, the agent can spend. Second, that default is not a sandbox. Docker's phrasing is that nothing sits between the agent and the host unless the operator puts it there. The piece does not attribute the scenario to a named incident; it is a category, not a case study. Anyone extrapolating specific companies, victims or numbers is filling in blanks the source did not. The runner problem, one hop to the left For CI operators this shape is familiar. A self-hosted Actions runner or a Jenkins agent that mounts the workspace, holds a checkout token and can call the host shell is a service you already isolate on purpose. You isolate it because the workflow you invited in is not always the workflow that runs. You isolate it because the token in the environment can do more than the job description. You isolate it because rollback of a bounded container is cheaper than reasoning about everything a process touched on a shared box. A coding agent living on the developer laptop occupies the same trust position, one machine earlier in the pipeline. It reads and writes the working tree. It holds session credentials to cloud APIs, the cluster and the registry. It executes instructions the developer did not always write, sometimes routed from

Pillar Security's latest research says AI coding agents can be pushed to act outside their sandbox through files and tools they were told to trust, and the operational read for anyone wiring one of these into CI/CD is straightforward: an agent invocation now behaves closer to a build runner reaching your production plane than to a chat window. DevOps.com's Jeff Burt covered the work on July 22. The researchers demonstrated multiple sandbox-bypass techniques and a parallel class of prompt-injection attacks embedded in READMEs, code comments and dependencies, per the DevOps.com writeup. OpenAI, Google and Cursor have patched several of the reported flaws. Pillar's argument, as summarised there, is that the injection surface reaches every file the agent trusts on the way to the model's prompt, and every tool it can call on the way back. What the sandbox actually covered None of this is entirely new to anyone who has already read Cyberhaven Lab's May note that adoption of AI coding agents is outpacing the security tools built to protect them. What Pillar adds is a concrete demonstration of the gap. A coding agent asked to do a legitimate job can be steered to take actions outside its supposed security boundary through content that arrives on paths the sandbox was not asked to police. Those are the same paths your CI already fetches for you: dependency manifests, README files, the code comments the model reads as context. That surface has been named before. HalluSquatting and GhostApproval, both referenced in the DevOps.com piece, already gave teams a taxonomy for how AI-adjacent supply-chain attacks reach developers and their tools. Pillar's research is the sandbox counterpart. Same theme, one layer deeper into the runtime. The pipeline read Two things fall out for anyone who owns a runner fleet. First, the agent's identity, network scope and filesystem access have to be tighter than the developer who invoked it, not looser. Second, a patched-vendor list is not a covera

A year ago, "it's just a ChatGPT wrapper" was a dismissal. You'd hear it about a startup and know what it meant: an LLM API call, a little RAG, file upload, a chat box on top. Thin. Replaceable. Probably dead the next time the base model shipped a feature. I keep coming back to that phrase, because it stopped being true in a way I didn't notice happening. The thing you'd be wrapping is no longer a model with a chat UI. It's a fast, stateful web application with its own agent loop, its own sandbox, its own artifact system. The wrapper didn't get easier to build as the models got better. It got heavier . The simple interface hides the hard part. A ChatGPT-shaped product is not just an API call with a chat box around it; it's the accumulation of many product and infrastructure decisions that make execution feel safe, stateful, and immediate. The model is the part you can buy. The surrounding runtime is the part people had to design. What gets me is the timescale. It's been roughly a year, and the question actually worth arguing about has moved out from under us — from "is this just a wrapper?" to "where does the sandbox even run?" The pace is faster than I can comfortably track. And the part I keep finding fun is that it all bends toward the practical, not away from it: every one of these shifts makes the tools more usable, more real, closer to something you'd actually ship. Surprising and, honestly, a good time to be building. This isn't a "wrappers are over" argument, and it isn't advice. It's me writing down where my thinking has drifted while trying to build these things myself — partly so I can find out where it's wrong. Read it as one person's notes. What "wrapper" used to mean The old shape was honestly small. Roughly: prompt → LLM API → (RAG retrieval) → response + file parsing on the side The whole game was prompt design, a retrieval index, and some glue. You could stand it up in a weekend. The reason "wrapper" was an insult is that the surface area was tiny —

A capability-compiler meets ten deliberately-broken MCP servers. The honest scorecard: it cleanly stops one class, shrinks the blast radius on several, and is useless against another. Knowing which is which is the whole point. Disclosure: I'm the author of capgate , the Apache-2.0 sandbox compiler this post puts to the test. The DVMCP project and the other tools mentioned aren't mine; the manifests and compiled output are reproducible from the repo . The setup Damn Vulnerable MCP (DVMCP) is a teaching project: ten MCP servers, each built to demonstrate one attack — prompt injection, tool poisoning, excessive permission scope, token theft, command injection, and so on. It's the closest thing the ecosystem has to a shared adversarial fixture. capgate is a compile-time tool. You write a manifest declaring what an MCP server is allowed to do — fs:read:/workspace/** , net:connect:api.github.com:443 , nothing else — and it compiles that to a concrete sandbox policy ( docker run flags, bwrap argv, or an egress-proxy config). It does not run anything, watch traffic, or inspect the server's code. It turns a declared capability set into an enforced boundary. So this is a fair, falsifiable test: for each DVMCP challenge, I wrote the honest minimum manifest, compiled it, and asked one question — does the boundary capgate emits actually stop the attack? The answer is not "yes" across the board, and the cases where it's "no" are the interesting ones. The bullseye: Challenge 3 — Excessive Permission Scope The vulnerable tool advertises "read a file from the public directory" and then does this: @mcp.tool () def read_file ( filename : str ) -> str : # VULNERABILITY: doesn't restrict file access to the public directory if os . path . exists ( filename ): # any absolute path works with open ( filename , " r " ) as f : return f . read () The private directory next door holds employee_salaries.txt , acquisition_plans.txt , and system_credentials.txt (a live DB password and cloud API ke

In sandbox runtimes, "isolation" is the core requirement. qwrap (based on bwrap user namespace) and Container (podman/docker) are two mainstream backends. They solve the same problem — running code in a restricted environment — but take completely different paths. This article uses extensive analogies to help you understand the similarities and differences. Building Intuition: Two Ways to "Lock the Door" Imagine you need to confine someone you don't fully trust in a room to do work: qwrap approach : In your existing house, you put up a partition to wall off a corner, leaving only a small window to pass materials through. The walls are still the original walls, the floor is still the original floor, but the person can only see what's inside the partition. Container approach : You build a shipping container with its own independent power, water, and ventilation systems. Put the person inside, close the door. They feel like they're in a complete little house, completely unaware of what's outside. This is the most fundamental difference: qwrap is lightweight view isolation, Container is complete environment encapsulation . What is qwrap (bwrap user namespace) qwrap uses bubblewrap (bwrap) under the hood, a sandboxing tool that leverages Linux user namespaces. How it Works Host filesystem ├── /usr/bin/python3 ← Host's Python ├── /home/user/project/ ← User project └── /tmp/secrets/ ← Sensitive files qwrap sandbox view (what the process sees) ├── /usr/bin/python3 ← bind-mounted in, read-only ├── /workspace/ ← Only the project directory is exposed └── (/tmp/secrets/ doesn't exist) ← Completely invisible Key mechanisms: User Namespace : The process thinks it's root, but actually maps to an unprivileged user on the host Mount Namespace : Only bind-mounts necessary directories in, everything else is invisible No images, no layers, no network namespace (unless explicitly configured) Analogy: VPN Split Tunneling qwrap is like split-tunneling rules on your phone — you're not wrap