Coding Agent Horror Stories: The Command You Already Approved | Docker

This post details a specific security vulnerability (CVE-2026-22708) in AI coding agent command allowlisting, where shell built-ins could be used to silently alter environment variables, leading to arbitrary code execution when a seemingly harmless command was approved. It explains how this attack works by manipulating environment variables like PAGER or PYTHONWARNINGS, and how it bypasses traditional allowlists. The post then contrasts this with Docker Sandboxes, explaining how they contain such attacks by running agents in isolated microVMs with their own kernels and filesystems, preventing access to host resources like SSH keys or persistent configuration files. It highlights that while the agent can still execute commands within the sandbox, its ability to exfiltrate data or persist changes is severely limited by the sandbox's network policies and ephemeral nature.