How Coding Agents Escape Their Sandbox: 4 Real Cases (DeepSeek, Codex, Mistral Vibe, brig)

Four different tools, four different flaws, and one shared pattern: the sandbox trusts something the agent can manipulate. This is the reference guide to how these escapes happen and what to review before giving an agent access to your code.

The four cases, side by side

An October 2026 roundup from Adversa AI gathers several recent flaws in coding agents. I reviewed the original reports for four of them:

Pattern 1: authenticating on data the agent controls

According to Ox Security’s analysis, DeepSeek Harness validated its local API by reading the Host header: if it said loopback, the request was considered trusted. The sandbox (bubblewrap/Seatbelt) limited file writes but left the loopback network open, so a confined agent could make a single curl to port 3080, switch its session to “danger-full-access,” and turn off approvals. Published timeline: reported August 24, patched August 27, CVE published September 8.

Pattern 2: the “safe” tool expands its own permissions

Accomplish AI’s report describes two escapes in Codex, both reported on August 12 and fixed within eight days. In “Overpatch,” apply_patch granted write access to the parent directories of the paths in the patch; naming /tmp opened up write access to the disk, and a symlink allowed modifying ~/.zshrc, running commands outside the sandbox in the next shell. In “Heapjack,” the Codex Desktop Node REPL stored a validation token in the V8 heap, reachable by untrusted code; with v8.getHeapSnapshot() the token could be read and requests to the parent process forged.

Pattern 3: validating a “reduced” version of the command and running the original

In Mistral Vibe, SecMate explains that the permissions layer used Tree-sitter to extract only the command name and a few arguments, discarding environment assignments, redirections, and expansions, while the shell received the full string. With PATH=./bin:$PATH cat README.md the checker saw cat README.md (allowed) and the shell resolved cat to an executable in the repository. Delivery required hostile content in the repo (commits, documentation, issues) that the model turned into a tool call. The fix was “fail-closed”: syntax the checker can’t model is no longer auto-approved.

Pattern 4: symlinks that resolve on the host

In brig, Endor Labs documents that an agent can replace a project subdirectory with a symlink; on the next run, brig resolved the link on the host and mounted the target read-write inside the sandbox. The workspace had symlink protections, but the project mount did not. The maintainers proposed calling it “project-mount symlink traversal” rather than “sandbox escape,” because the microVM’s isolation remained intact.

What this means for a company using coding agents