Your AI agent is sandboxed. Are its tools?

A coding agent is working inside a sandbox: a restricted area meant to keep its commands away from files and networks they do not need. That sounds reassuring. But the agent can also call tools, and a tool is a separate program. If that program runs outside the sandbox, it has whatever access the person who launched it has.

In 2025 and 2026, that gap produced two security flaws, each with a CVE number, in Anthropic's own Git tool server. Researchers describe how they worked, and how many other tools might share the pattern, in an October 2026 preprint. 1

One tool, two steps, one SSH key

The Model Context Protocol, or MCP, is the standard way an AI assistant discovers and calls outside tools: one might search a repository, another might read a document. A tool server is a program on your computer, and the protocol's own security guide says a local server is "an ordinary operating system process" running with all the access of the account that launched it. MCP does not sandbox it. 2

Here is how that mattered in the Git tool server, according to the paper. 1

1. The git_init tool turns a folder into a Git repository. It accepted any folder path the caller named, so a steered agent could point it at ~/.ssh, where private login keys live. (CVE-2025-68143)
2. The git_add and git_diff_staged tools then did their ordinary jobs inside that "repository." The diff output handed the contents of the SSH private keys back to the agent.
3. A separate flaw (CVE-2026-27735) let git_add accept paths containing ../ and stage files from outside the repository, which a later diff could display.

Each call looked like routine Git work. The approval prompt a person sees shows the tool and its arguments, not what the program behind it is able to touch. The authors call this filesystem capability laundering: a task that sounds narrow is used to exercise much broader file access. Both flaws have been fixed; the first by removing git_init from the server and the second in version 2026.1.14. 1

What the sandbox changed

The researchers tested each case three ways, using planted fake credentials. With no sandbox, the attack returned the fake key. With a sandbox, an ordinary request on an in-scope file worked. With the sandbox, the same attack got a permission-denied error and no key bytes. All 150 instances they confirmed passed this test, which means the sandbox helped when it was wrapped around the tool's process, not only the agent. 1

How common is it?

The team catalogued 21,097 MCP servers from nine registries and triaged 4,806 of them. Of those, 787 (16.4 percent) could use the filesystem even though they were not classified as file tools. Dynamic testing confirmed 150 vulnerable instances under the tested sandbox policies, and the authors' disclosures produced 13 security advisories. These counts describe the researchers' selection and tests, not a failure rate for every MCP server. The work is a preprint and has not been through journal peer review. 1

Check each tool, not just the agent

The guide calls running third-party servers in a container, sandbox or virtual machine the most effective single mitigation, and tells users to give each server only the secrets it needs. 2

Whether that happens depends on the host. In VS Code, for example, agent sandboxing for terminal commands is off by default (chat.agent.sandbox.enabled). When it is turned on, locally launched MCP servers are covered by a separate setting that defaults to on, but servers a person starts on their own are not. 3

So for each tool, ask who installed it, where it runs, and which folders, credentials and network services it can reach. A sandbox protects only what is inside it.

References

1. My Credentials, Please: Detecting Filesystem Capability Laundering in MCP Servers at Scale. (n.d.). https://arxiv.org/abs/2610.22301
2. Local MCP server security. (n.d.). https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tutorials/security/local-server-security.mdx
3. Sandbox Copilot agent sessions. (n.d.). https://code.visualstudio.com/docs/agents/run/agent-sandboxing