A critical flaw in Docker Sandboxes — the product that runs AI coding agents inside their own small virtual machines on macOS — allowed malicious guest code to break out of the sandboxed project directory and read or modify files anywhere on the host machine. The vulnerability, CVE-2026-77179, was rated Critical and affected all releases from version 0.28.0 up to but not including 0.42.0. Docker patched it on September 7, 2026.
The escape worked through a flaw in the virtio-fs host server, the component responsible for sharing the project directory between the Mac and the virtual machine. By replacing a parent directory with a symbolic link while a file operation was in progress, a guest process could trick the host side of the file share into following the link to an arbitrary location outside the workspace. The access runs with the privileges of the host user account that manages the virtual machine, meaning a compromised or malicious AI agent could theoretically read SSH keys, configuration files, or any other data accessible to that user. Docker also fixed a second related flaw in the same 0.42.0 release. Docker has not reported any exploitation of either issue in the wild, and CISA’s assessment lists no active exploitation.
How to check if you’re affected
Affected versions of Docker Sandboxes on macOS are 0.28.0 through 0.41.x — version 0.42.0 contains the fix. Open Docker Desktop, go to Settings, and check the displayed version. Alternatively, run docker sandbox version from a terminal. If you are on any version before 0.42.0 and use Docker Sandboxes with AI coding agents, update immediately through Docker Desktop’s update prompt or from the Docker website.