Docker explains the pitfalls of command authorization: simply granting 'safe commands' to an AI agent can lead to arbitrary code execution.
'AI coding agents,' which use AI to assist with programming, employ a mechanism that prompts the user for confirmation before executing dangerous commands. However, on August 18, 2026, Docker presented a case where an attacker's code could be executed even if the user approved a command that appeared safe.
Coding Agent Horror Stories: The Command You Already Approved | Docker
The AI coding agent can not only create code but also execute commands in the terminal. To avoid interrupting the process by requiring permission every time, a mechanism is in place to automatically execute commands deemed highly secure, such as 'git,' by adding them to an allow list.
Docker highlighted a vulnerability, 'CVE-2026-22708,' found in the AI code editor 'Cursor.' Although this vulnerability was fixed in Cursor 2.3, in the affected environment, certain shell built-in commands, such as 'export,' could be executed without user confirmation, allowing environment variables to be modified.
For example, Git refers to an environment variable called 'PAGER' when determining how output is displayed. If an attacker manipulates an AI agent to rewrite PAGER, and the user approves a 'git branch' that appears safe, the Git process can trigger the execution of code specified by the attacker.
The technique of exploiting environment variables has been known for some time. However, AI agents can read text contained in READMEs, dependent packages, and issue comments, and automatically execute multiple operations in succession. Therefore, attacks that previously required terminal access and multiple operations can now potentially be carried out automatically by an AI agent that has read malicious text. Docker explains that a permission list that only checks command names is not sufficient to ensure the security of AI agents.
As a solution, Docker introduces 'Docker Sandboxes.' Docker Sandboxes is a mechanism that runs AI coding agents in a small virtual machine called a 'microVM,' which is isolated from the host OS. It provides an environment where AI agents can freely execute code, while controlling authentication information and access to external networks outside the sandbox.
In Docker Sandboxes, AI agents are deployed within microVMs, and external communication is routed through a proxy. Raw authentication information such as API keys and SSH private key files are not placed directly within the microVM, and the accessible networks are restricted by rules.
Using Docker Sandboxes ensures that even if environment variables are modified and attack code is executed within a microVM, it cannot directly access areas that are not shared on the host side.
In the example shown by Docker, even if PAGER is overwritten and malicious processing is executed due to an attack, the host's SSH private key file does not exist within the microVM, so the attack code cannot read and extract the private key itself. However, by default, the working directory is shared with the host in a read/write manner, so it is not completely isolated from all data.
Docker states that it is more useful to pre-define the range that an AI agent can reach than to try to accurately determine whether every instruction the AI agent reads is safe.
Related Posts:
