Contextual Sandbox Escape

The attacker crafts a prompt that convinces the agent it must generate code to fulfill a legitimate task, but the generated code contains escape logic. The agent's own output becomes the attack vector.

• Attacker primes context with a scenario requiring system-level access
• Agent autonomously writes Python or shell code to satisfy the request
• Generated code includes subprocess calls, os.system invocations, or file operations
• Escape payload is not injected—it is synthesized by the agent itself

The agent is manipulated into calling its own tools with attacker-controlled parameters that expand its execution scope beyond the sandbox boundary.

• Attacker reframes a restricted tool as necessary for a benign goal
• Agent passes crafted arguments that trigger path traversal, command injection, or privilege escalation
• Example: Convincing an agent with read_file access to instead call exec by describing it as a 'dynamic configuration loader'
• The sandbox trusts the agent; the agent trusts the poisoned context

The attacker injects reasoning steps that cause the agent's self-reflection or planning mechanisms to identify the sandbox as an obstacle to be overcome, rather than a security boundary to be respected.

• Agent is prompted to 'debug why the task failed'
• Attacker plants a false diagnosis: 'The sandbox is blocking necessary operations'
• Agent autonomously plans and executes escape as a sub-goal
• The escape becomes a rational step in the agent's chain-of-thought, not a malicious action

The escape is achieved not in a single prompt, but through a sequence of interactions that gradually erode safety constraints and expand the agent's operational envelope.

• Turn 1: Establish trust and helpful persona
• Turn 3: Request a small, seemingly safe system operation
• Turn 5: Build on previous outputs to request broader access
• Turn 8: Agent has accumulated enough context to justify full sandbox escape
• Each step is individually benign; the cumulative context is the weapon

Once code execution is achieved, the agent is manipulated to exfiltrate sandboxed data through observable side channels that bypass output filtering.

• Data is encoded into generated image descriptions, URL parameters, or tool call arguments
• Agent writes sensitive files to world-readable temporary directories
• Exfiltration occurs through DNS tunneling or HTTP callbacks embedded in generated code
• The sandbox monitors for direct network access but misses semantic data leakage through the agent's own output stream

The attacker manipulates the agent into importing or installing a malicious package from an external registry, exploiting the agent's ability to execute package management commands.

• Attacker describes a fictional library that 'solves the user's problem'
• Agent executes pip install or npm install with an attacker-specified package name
• Malicious package contains pre-install scripts that execute outside the sandbox
• The escape leverages the supply chain, not a direct code injection

An attack where the response from an API or function call is intercepted and replaced with malicious content. The agent then ingests this as trusted context for subsequent actions.

Key mechanisms:

• Man-in-the-middle interception of tool call responses
• Compromised API endpoints returning crafted payloads
• DNS rebinding to redirect tool calls to attacker-controlled servers

This is a direct precursor to sandbox escape, as poisoned tool outputs can instruct the agent to execute arbitrary code outside its intended boundaries.

The defensive counterpart to contextual sandbox escape. Core techniques include:

• gVisor and Firecracker micro-VM isolation for each agent execution
• Seccomp profiles restricting available syscalls
• Least-privilege IAM for tool authentication tokens
• Network egress filtering preventing outbound connections to attacker infrastructure

Effective sandboxing assumes the agent will be compromised and focuses on blast radius limitation through defense-in-depth.

A gatekeeping layer that inspects agent-generated actions before execution. Critical for catching sandbox escape attempts:

• Static analysis of generated code for dangerous imports like os, subprocess, or ctypes
• Capability-based allowlists that reject any tool call not explicitly permitted
• Human-in-the-loop approval gates for high-risk operations such as file system writes or network connections

Validation acts as the last line of defense when sandbox isolation fails.

The injection of malicious reasoning steps into an agent's scratchpad or reflection loop. An attacker crafts context that causes the agent to:

• Adopt a flawed logic path justifying why sandbox escape is necessary
• Generate self-persuasive rationalizations for violating safety constraints
• Override its own refusal mechanisms through recursive reasoning corruption

This attack exploits the agent's metacognitive processes to achieve escape without directly injecting executable code.

Emergency termination mechanisms for when sandbox escape is detected or suspected:

• Circuit breakers that halt execution when anomaly scores exceed thresholds
• State rollback to a known-clean checkpoint before the attack began
• Out-of-band termination signals that bypass the agent's own reasoning loop
• Graceful degradation that revokes all tool credentials while preserving audit logs

Kill switches must operate independently of the agent's control plane to prevent an escaped agent from disabling them.