Threat dossier · P1

Sandbox and permission-boundary breakout

Coding agents are routinely launched with approval bypasses or broad host access for speed; one successful injection inside that mode becomes immediate, unattended execution with the developer’s own privileges.

Direct answer

What is sandbox and permission-boundary breakout?

A sandbox or permission-boundary breakout happens when agent work loses containment — approval prompts are bypassed with auto-approve flags, broad shell access, or escalated credentials — so any injected or mistaken plan runs unattended on the machine.

Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.

Copied text includes the canonical source and review date.
Reviewed Reviewer: HOL Guard EngineeringReview cadence: 30 days

Representative attack path

Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.

  1. Step 1

    An agent is run with an approval bypass or overly broad permissions.

  2. Step 2

    Malicious context or a mistaken plan reaches the agent.

  3. Step 3

    The plan executes with no human checkpoint or sandbox boundary.

  4. Step 4

    Filesystems, credentials, or infrastructure are modified before anyone reviews.

Coverage boundary

What this control can cover

  • Pre-action policy evaluation on supported action surfaces even when the harness runs with auto-approve settings.
  • Destructive or irreversible command classes can require explicit policy exceptions.

What it does not prove or prevent

  • Processes the agent spawns that never traverse a supported harness action path.
  • Container, VM, or operating-system-level isolation of the host itself.

Policy pattern

Policy pattern for sandbox and permission-boundary breakout

Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.

Use when: Coding agents are routinely launched with approval bypasses or broad host access for speed; one successful injection inside that mode becomes immediate, unattended execution with the developer’s own privileges.

Decision pattern

  1. Identify the trust boundary and consequential action class.
  2. Apply least privilege and the narrowest supported policy.
  3. Require review for sensitive or ambiguous actions.
  4. Preserve only redacted, versioned evidence needed to reproduce the decision.

Limitations

  • Processes the agent spawns that never traverse a supported harness action path.
  • Container, VM, or operating-system-level isolation of the host itself.

If you suspect prompt injection

  1. Step 1

    Response 1

    Kill the agent session and its child processes.

  2. Step 2

    Response 2

    Assess filesystem, repository, and credential state for changes.

  3. Step 3

    Response 3

    Rotate credentials reachable from the session context.

  4. Step 4

    Response 4

    Re-run with approval boundaries restored before continuing the task.

Sources and mappings

Related dossiers

Neighboring threat classes that share attack paths or trust boundaries with this dossier.