Docker Sandboxes flaw let an agent inside the sandbox plant a symlink so the user's next 'sbx cp' read or overwrote host files (CVE-2026-103916); fixed in 0.51.0
What to do: update the sbx CLI to 0.51.0 or later. More generally, treat anything an agent leaves in a shared folder as untrusted: check for symlinks before copying out of a sandbox, and keep credentials out of directories a sandboxed agent's output can be copied toward.
Sources: GitHub Advisory: Docker Sandboxes sbx cp does not safely confine host-side paths (CVE-2026-103916) · Endor Labs: Docker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (Nov 3)