AckuityRequest assessment
Menu

ROGUE PIXEL · Research finding

The copy took another path.

This is a disclosed research demonstration involving a later user-initiated copy, not an observed attack. The closing lesson is proposed; Ackuity was not involved.

Read the narration

Allowlist held. Copy channel did not. A workspace symlink let an operator's copy pull a host file into Docker Sandboxes. Fixed in version zero point fifty-one point zero. Check every path, outside the agent.

Read the visual story

An agent plants a workspace symlink. A later operator copy brings a host canary into the sandbox through a separate channel. The illustration identifies v0.51.0 as the fix and closes with a proposed path-check lesson.

By Ackuity · Published

Endor Labs found that a separate copy channel could follow a workspace symlink outside approved host paths. The shared-filesystem allowlist held; a later operator copy triggered the access.

THE CONTROL LESSON

What should we watch for?

Ackuity’s view: validate the resolved source and destination of each file action outside the agent’s control, before it runs.

THE EVIDENCE

What does the report establish?

The finding concerns the standalone Docker Sandboxes sbx CLI, not Docker Desktop. Planting a symlink alone did not access the host; a later operator copy was required. Canary read/write tests do not establish exploitation in the wild or demonstrated code execution. November 3 is the disclosure and fix date.

Read the full account

Endor Labs demonstrated host-file reads and overwrites through sbx cp. Docker’s v0.51.0 release blocks workspace symlink escapes.

A shared-filesystem restriction does not automatically govern a separate copy channel.

ORIGINAL REPORTING & EVIDENCE

PUT THE LESSON TO WORK

Do all file channels enforce the same boundary?

In an isolated test, check resolved source and destination paths for copies as well as shared files. Use canary files outside the approved workspace and verify that reads and writes remain blocked.

Evaluate file-action scope and outcomes

Explore Ackuity’s Agent Execution Control Switch

Request an Agent Exposure Assessment