T05 · Unauthorized Access and Privilege Escalation
- Location
references/runtime-wsl.md:18- Finding
Instruction to Bypass Sandbox Isolation During Artifact Writes
- Content
View full analysis
Vulnerability Details
File Location:
references/runtime-wsl.md:18
Vulnerability Type: Sandbox-boundary bypass
Risk Level: HighVulnerable snippet:
markdown - If a socket error occurs while writing task artifacts, try using a shell loop outside the sandbox.Technical Analysis
The runtime guidance explicitly instructs the agent to move execution outside the sandbox if a socket error occurs while writing artifacts. A sandbox is a security boundary intended to constrain filesystem, process, network, and host access. Treating a routine write failure as authorization to leave that boundary violates least-privilege principles.
The instruction does not constrain the external shell loop, specify permitted paths, require user confirmation, or define an allowlist of operations. Consequently, the command ultimately generated by an agent could operate with the broader permissions of the host-side agent process. The exact privileges available depend on the surrounding runtime and user account.
Attack Path
- A task invokes the WSL-specific runtime guidance.
- An artifact write encounters, or appears to encounter, a socket-related error.
- The agent follows the documented fallback and constructs a shell loop outside the sandbox.
- The loop executes beyond the original isolation boundary.
- If generated paths or shell arguments are unsafe or attacker-influenced, the operation may access or modify host resources that were unavailable inside the sandbox.
Impact Assessment
Successful exploitation could expose host files, processes, or network resources available to the agent's operating-system account. It could also allow artifact-writing operations to modify data outside the intended workspace. The maximum scope is bounded by the privileges of the external shell process, but those privileges are broader than the sandboxed task legitimately requires.
- Remediation
View remediation
Remediation Suggestions
- Remove the instruction to execute a shell loop outside the sandbox.
- Keep all artifact creation and retry operations within the configured sandbox and workspace.
- Treat socket failures as recoverable errors and report them to the user if sandboxed retries fail.
- Canonicalize and validate every artifact destination before writing it.
- Restrict destinations to an explicit workspace allowlist and reject path traversal, symbolic-link escapes, UNC paths, and unexpected absolute paths.
- If an external operation is operationally unavoidable, require explicit user approval and use a narrowly scoped helper with fixed arguments rather than generated shell code.
- Log the approved operation and verify that the destination remains within the authorized artifact directory.