Skip to content
Agent sandbox escapes: five versions to check today
Back to Blog
#Codex sandbox escape#Claude Code 2.1.247#Cursor CLI#Docker CVE-2026-77179#coding agent security#core.fsmonitor#reshaped-v3

Agent sandbox escapes: five versions to check today

Amir Khan

Check five version numbers today, before anyone on your team opens another client's repository. Claude Code 2.1.247, Cursor CLI 2026.08.04-aaa8809, Codex CLI 0.149.0, Codex Desktop build 26.818.21641, and Docker Desktop 4.88.0 if Docker VMM is switched on. Those are the versions that close four coding-agent sandbox escapes and one hole in the hypervisor underneath them, all published inside five weeks by one lab. Every one of the agent escapes begins the same way: somebody clones a repository and opens it. In three of the four the agent never ran a shell command at all.

ToolEscapeFixed in
Claude Code (macOS)Beltdown, via core.fsmonitor2.1.247
Cursor CLI (macOS)Beltdown2, same class2026.08.04-aaa8809
Codex CLIOverpatch, via apply_patch0.149.0
Codex Desktop (macOS)Heapjack, via node_replbuild 26.818.21641
Docker Desktop / Sandboxes (macOS, Docker VMM)CVE-2026-77179, virtio-fs4.88.0 / 0.42.0

Versions as published by Accomplish AI and confirmed by the vendors.

Why opening a repository is enough

Two of the four are one git setting. A repository's own .git/config can name a program under core.fsmonitor, and git runs that program whenever it looks at the working tree. Claude Code and Cursor both ran their own housekeeping git commands outside the sandbox that wrapped the agent's shell, so the repository's program ran outside it too — with the access your user account has, including SSH keys and cloud credentials.

Diagram of the six-step escape: an armed repository, an agent run with the sandbox on, an ordinary read-only turn, the harness running internal git, git honouring core.fsmonitor, and a payload writing to the home directory
The escape path, and the three independent places it can be closed. From Beltdown2: Escaping the Cursor CLI sandbox, Or Hiltch, Accomplish AI.

Cursor's fix is four environment variables applied to every git spawn, which the researchers call the right approach because it leaves no call site to forget. These four lines are the one thing here you can copy today, into any CI job that runs git against code your team did not write:

GIT_CONFIG_COUNT=4
GIT_CONFIG_KEY_0=safe.bareRepository   GIT_CONFIG_VALUE_0=explicit
GIT_CONFIG_KEY_1=core.fsmonitor        GIT_CONFIG_VALUE_1=false
GIT_CONFIG_KEY_2=core.hooksPath        GIT_CONFIG_VALUE_2=/dev/null
GIT_CONFIG_KEY_3=core.attributesFile   GIT_CONFIG_VALUE_3=/dev/null

The two Codex bugs are different mechanisms with the same shape. Overpatch let the patch tool work out its own write permissions from the paths inside the patch, so a line naming /tmp widened the grant to the whole disk. Heapjack sat in the JavaScript tool Codex Desktop writes into the global config at install: it keeps trusted and untrusted code in one Node process, and the token that told them apart lived in the shared heap where the untrusted side could snapshot and read it. That one ran in read-only mode, the strictest setting Codex has.

"The thing doing the enforcement was sitting inside the thing being enforced."

What to do this week

  1. Run the checks: claude --version, codex --version, sbx --version, and for Docker, Settings → General → Virtual Machine Manager. Any earlier build with Docker VMM selected is affected.
  2. Open anyone else's repository — a client's, a contractor's, one from a job board — in a throwaway VM or a container with no Docker socket mounted, on a machine that holds no production credentials. A read-only setting is not a substitute: Heapjack ran in read-only mode.
  3. Put the four GIT_CONFIG lines into every CI job that clones third-party code.
  4. Write one sentence into the policy document. A cloned repository is a program you run.

One caveat worth stating to your own team: Accomplish AI, which found all five, sells a VM-isolated agent runner and says so in each writeup. The vendors confirmed the fixes, so the findings stand; the framing is a vendor's. Three of the four agent escapes are macOS-specific, while Overpatch is in the open-source Codex CLI and runs anywhere.

If you want those checks and that one-sentence rule built into how your team actually ships, talk to Vesprr's software team.

Sources