{"vulnerability": "CVE-2026-2270", "sightings": [{"uuid": "7209b005-f00c-44be-8df2-995eade6502e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3mdlbafvnhr2e", "content": "", "creation_timestamp": "2026-01-29T17:00:55.634004Z"}, {"uuid": "c814d294-286e-4101-9c43-55049a662dd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/cybersentinel404.bsky.social/post/3mdj2kagvhb2x", "content": "", "creation_timestamp": "2026-01-28T19:55:49.565811Z"}, {"uuid": "05252675-08cc-4c40-b624-0576ecfde33e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mdsjzf5yh32b", "content": "", "creation_timestamp": "2026-02-01T14:26:41.978549Z"}, {"uuid": "6ce825b7-b163-4dcd-af93-26c92b0f776a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mdk2ps3ogn2w", "content": "", "creation_timestamp": "2026-01-29T05:31:36.058921Z"}, {"uuid": "03a2041b-2354-4e55-9779-d71bc7f410bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://gist.github.com/wjfthomas318-rgb/d49fe89d834bef509935619321441590", "content": "", "creation_timestamp": "2026-01-30T00:14:06.000000Z"}, {"uuid": "02c895a2-03b4-45ee-999a-b69ac2476f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mdkg525fsc2q", "content": "", "creation_timestamp": "2026-01-29T08:55:52.311740Z"}, {"uuid": "9d3fc7e9-7090-4c80-b407-74e8a3873194", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-22709", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mfxqtkydro26", "content": "", "creation_timestamp": "2026-03-01T03:02:24.892013Z"}, {"uuid": "606d9524-bd5c-491d-8082-ca320c06f206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22708", "type": "seen", "source": "https://gist.github.com/stvhay/a2924174b187b414e326fff136326d15", "content": "", "creation_timestamp": "2026-02-21T09:00:28.000000Z"}, {"uuid": "ad334f02-3a45-41e7-b3d5-5b8ced8dcc20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22704", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mc2juuojxi2u", "content": "", "creation_timestamp": "2026-01-10T07:55:07.548114Z"}, {"uuid": "914fa45d-4f6a-48fd-8eef-0933ec614310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22705", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mc2mffgb2d2e", "content": "", "creation_timestamp": "2026-01-10T08:40:06.833637Z"}, {"uuid": "6cb7fe75-e584-45ff-a7f0-8e4d964048c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22704", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mc3abqoroh2v", "content": "", "creation_timestamp": "2026-01-10T14:35:59.704206Z"}, {"uuid": "4b9b057f-0f5d-44d4-8604-4be781dc3e9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22700", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mc3b3n5c262f", "content": "", "creation_timestamp": "2026-01-10T14:50:28.245650Z"}, {"uuid": "90241dc6-f453-47be-bb85-d9fe3f220646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "5360916d-0544-44d6-9230-9798e023b256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22702", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "042daa45-7379-4d1b-b1d3-b9eb9ec94f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22701", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/", "content": "", "creation_timestamp": "2026-03-18T00:00:00.000000Z"}, {"uuid": "3ade0fdf-0125-485a-bf38-05c3b689ef78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://gist.github.com/alon710/1fb96b420a8b830c89c04efb72f37651", "content": "", "creation_timestamp": "2026-01-24T21:25:39.000000Z"}, {"uuid": "9fff40bd-b1ce-47ec-95ab-735d24c9f968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22705", "type": "seen", "source": "https://gist.github.com/alon710/e3ec186ce8b74384cab686a3c957fefe", "content": "", "creation_timestamp": "2026-01-24T21:25:36.000000Z"}, {"uuid": "d6a30c0a-b964-4ce7-961d-15f92567ac74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22704", "type": "seen", "source": "https://gist.github.com/alon710/d73ab60e6a5b0c429d12ed3f16361991", "content": "", "creation_timestamp": "2026-01-24T21:25:34.000000Z"}, {"uuid": "b7c0d469-f745-4bc0-bbc6-b6a681afc396", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://gist.github.com/alon710/5ac3689b8a5fa01f88bcf801ac1b0886", "content": "", "creation_timestamp": "2026-01-24T22:41:03.000000Z"}, {"uuid": "e43f321a-db6b-4ef4-a39a-a9727504ad66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22705", "type": "seen", "source": "https://gist.github.com/alon710/78b361a560ea3ac3c636b848b70465ab", "content": "", "creation_timestamp": "2026-01-24T22:41:00.000000Z"}, {"uuid": "f0e1a50d-74e1-4f51-b936-2027b3990b12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://gist.github.com/alon710/1a9dd02522093ff2ceb805cf35c0f14f", "content": "", "creation_timestamp": "2026-01-26T19:10:38.000000Z"}, {"uuid": "4a692084-6222-4530-846e-065e82f60298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mdechvpf7f2g", "content": "", "creation_timestamp": "2026-01-26T22:34:23.152172Z"}, {"uuid": "42438f61-ef14-45d6-afe4-2100454d7676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mdem2i6ogs2j", "content": "", "creation_timestamp": "2026-01-27T01:25:49.569545Z"}, {"uuid": "dc534afa-e84b-4a01-9b13-fa8e6f959adb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/cyberdudebivash.bsky.social/post/3mdfrjuw4gs2w", "content": "", "creation_timestamp": "2026-01-27T12:36:38.996259Z"}, {"uuid": "c3249a83-68e1-401a-9867-feb1c9ebe2c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mdfrjzpuyb2h", "content": "", "creation_timestamp": "2026-01-27T12:36:39.635451Z"}, {"uuid": "abcef6c9-a78c-44bb-81bd-89c4bbe3d27e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mdftrth6pu2a", "content": "", "creation_timestamp": "2026-01-27T13:16:50.344532Z"}, {"uuid": "e9b17f8d-5852-4ffd-a8b4-10c69336929a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mdg7qfomlt2m", "content": "", "creation_timestamp": "2026-01-27T16:50:46.039204Z"}, {"uuid": "e253b67e-0593-4d2b-a3a7-5a1ebe09a3d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mdgcgcotxs2v", "content": "", "creation_timestamp": "2026-01-27T17:38:48.761280Z"}, {"uuid": "fb5db848-677a-4e63-bb81-fe532900bf94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-22709", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mdhz5vpq6s26", "content": "", "creation_timestamp": "2026-01-28T09:58:22.095370Z"}, {"uuid": "ec2375b3-5417-415a-bbd1-7be52b2064f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/cybersentinel404.bsky.social/post/3mdiic73fuu2a", "content": "", "creation_timestamp": "2026-01-28T14:29:12.684315Z"}, {"uuid": "23dbdce4-6f39-40b8-9f41-d46471f460aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mdiigft2qxt2", "content": "", "creation_timestamp": "2026-01-28T14:31:37.062949Z"}, {"uuid": "230b0550-6f52-43da-b715-82e62d977204", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/115973224640436386", "content": "", "creation_timestamp": "2026-01-28T14:36:12.057475Z"}, {"uuid": "958433e0-ff62-42ce-b8b4-d9428325510e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://thehackernews.com/2026/01/critical-vm2-nodejs-flaw-allows-sandbox.html", "content": "", "creation_timestamp": "2026-01-28T13:01:00.000000Z"}, {"uuid": "fcbd9f4a-29da-4d3c-8b15-9754232b80e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://threatintel.cc/2026/01/28/critical-vm-nodejs-flaw-allows.html", "content": "", "creation_timestamp": "2026-01-28T13:36:23.000000Z"}, {"uuid": "169e1c8d-7b7e-48ae-b524-df499763319a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mditfr6udl2w", "content": "", "creation_timestamp": "2026-01-28T17:48:03.762193Z"}, {"uuid": "cef43360-1390-4ff1-8b12-8fc2978fb577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22700", "type": "seen", "source": "Telegram/i2g9ck4oFpG2FQ6NO-wq7UgJ3FLiFKBZXo4--EYsPHmrFO0", "content": "", "creation_timestamp": "2026-01-10T07:01:39.000000Z"}, {"uuid": "2def31f8-3e02-484e-8bea-f0e8a0c186d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22705", "type": "published-proof-of-concept", "source": "Telegram/WQqRawnFxdQj2C7QSZvJhJYu2ip6AHddUppaVRsAsIpfVRo", "content": "", "creation_timestamp": "2026-01-10T08:01:06.000000Z"}, {"uuid": "97a263d0-17d9-4281-82d2-864ffa196da5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22704", "type": "published-proof-of-concept", "source": "Telegram/WQqRawnFxdQj2C7QSZvJhJYu2ip6AHddUppaVRsAsIpfVRo", "content": "", "creation_timestamp": "2026-01-10T08:01:06.000000Z"}, {"uuid": "0270f3e1-4e27-4369-934a-ff1130984838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22704", "type": "seen", "source": "https://bsky.app/profile/exploitdb-bot.bsky.social/post/3mkmy7mrh7l27", "content": "\ud83d\udea8 New Exploit: HAX CMS 24.x - Stored Cross-Site Scripting (XSS)\n\ud83d\udccb CVE: CVE-2026-22704\n\ud83d\udc64 Author: banyamer\n\n\ud83d\udd17 https://www.exploit-db.com/exploits/52526\n\n#ExploitDB #InfoSec #CyberSecurity #CVE-2026-22704", "creation_timestamp": "2026-04-29T11:21:06.628614Z"}, {"uuid": "02051db3-57b8-4bb9-b410-c080c01a38dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "published-proof-of-concept", "source": "https://t.me/breachdetect/1061751", "content": "{\n  \"Source\": \"https://gerki.pw/\",\n  \"Content\": \"CVE-2026-22709, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435 \u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a. \u041f\u043e\u0447\u0435\u043c\u0443 \u0431\u0430\u0433 \u0432 vm2 \u2014 \u044d\u0442\u043e \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0430 \u0434\u043b\u044f Node.js \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u044b\", \n  \"author\": \"\",\n  \"Detection Date\": \"01 Feb 2026\",\n  \"Type\": \"Data leak\"\n}\n\ud83d\udd39 t.me/breachdetect  \ud83d\udd39", "creation_timestamp": "2026-08-22T14:00:14.977193Z"}, {"uuid": "51063f72-bbe1-4c12-a216-6ac57ca77c65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22700", "type": "published-proof-of-concept", "source": "https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-j9xq-69pf-pcm8", "content": "", "creation_timestamp": "2026-01-09T18:45:00.000000Z"}, {"uuid": "fc225737-be6c-46c0-92e6-d0335faa89a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-22704", "type": "published-proof-of-concept", "source": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778", "content": "", "creation_timestamp": "2026-01-09T18:45:17.000000Z"}, {"uuid": "fab2796f-ee1c-43df-a3a8-b2c581cb05ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22703", "type": "seen", "source": "https://bsky.app/profile/persikbl.bsky.social/post/3mu7zqzamlj2f", "content": "In January a cosign bundle could be crafted to verify successfully even though its embedded Rekor entry didn't reference the artifact's digest, signature or public key.\n\nCVE-2026-22703.\n\npodostack.com/p/issue-032...", "creation_timestamp": "2026-08-29T13:56:03.111377Z"}, {"uuid": "6bcf2882-bd8d-4cc1-b2ed-2fc05a0e0908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22708", "type": "seen", "source": "https://gist.github.com/AfvanJaffer/8b427775455df5679cc487a0f92dc1b9", "content": "#!/bin/bash\n#\n# Checks whether this machine shows any artifact of having been targeted\n# by the disclosed Cursor IDE CVEs discussed in this investigation:\n#\n#   CVE-2025-54136  \"MCPoison\"   -- MCP config trust bypass\n#   CVE-2026-26268                -- sandbox escape via .git/hooks\n#   CVE-2026-22708                -- shell environment poisoning (prompt injection)\n#   CVE-2026-50548 / CVE-2026-50549  \"DuneSlide\" -- sandbox escape via prompt injection\n#   CVE-2026-63093                -- Windows-only git.exe binary planting (N/A on macOS,\n#                                     checked anyway as a trivial negative-confirmation)\n#\n# IMPORTANT, read before trusting the output:\n#   - CVE-2026-26268 (git hooks) and CVE-2025-54136 (MCP config history) leave\n#     STATIC, verifiable artifacts on disk -- those checks are strong evidence.\n#   - CVE-2026-22708 and DuneSlide are prompt-injection-driven behavioral\n#     exploits with no documented static signature. Those checks are\n#     BEST-EFFORT / LOW-CONFIDENCE: they look for exec-event and local-storage\n#     traces, but absence of a hit here does NOT prove the machine was never\n#     hit, only that no evidence of it was found by these particular queries.\n#   - All captured text is masked before being written to disk (see\n#     mask_secrets()).\n#   - Read-only / non-destructive.\n#\n# Usage:\n#   chmod 700 ./cursor_cve_exposure_check.sh\n#   sudo /bin/bash ./cursor_cve_exposure_check.sh [lookback_days] [trusted_org_pattern]\n#\n#   lookback_days defaults to 60. trusted_org_pattern defaults to \"fastfishio\"\n#   (case-insensitive substring match against git remote URLs) -- change it\n#   if your actual GitHub org differs; anything NOT matching is flagged for\n#   manual review, not assumed malicious.\n\nset -u\numask 077\n\nif [[ \"$EUID\" -ne 0 ]]; then\n    echo \"ERROR: Run using sudo (sudo /bin/bash ./cursor_cve_exposure_check.sh).\"\n    exit 1\nfi\n\nLOOKBACK_DAYS=\"${1:-60}\"\nTRUSTED_ORG=\"${2:-fastfishio}\"\n\nHOSTNAME_NOW=\"$(/usr/sbin/scutil --get ComputerName 2>/dev/null || /bin/hostname)\"\nSAFE_HOST=\"$(printf '%s' \"$HOSTNAME_NOW\" | /usr/bin/tr ' /:' '___' | /usr/bin/tr -cd '[:alnum:]_.-')\"\nSTARTSTAMP=\"$(/bin/date '+%Y%m%d_%H%M%S')\"\n\nOUT=\"$(/bin/pwd -P)/cursor_cve_check_${SAFE_HOST}_${STARTSTAMP}\"\n\n/bin/mkdir -p \\\n    \"$OUT/00_SUMMARY\" \\\n    \"$OUT/01_VERSION_CHECK\" \\\n    \"$OUT/02_GIT_HOOKS_CVE-2026-26268\" \\\n    \"$OUT/03_MCP_HISTORY_CVE-2025-54136\" \\\n    \"$OUT/04_BEHAVIORAL_CVE-2026-22708_DuneSlide\" \\\n    \"$OUT/05_WINDOWS_ONLY_CVE-2026-63093\" \\\n    \"$OUT/06_UNTRUSTED_REPO_REMOTES\"\n\ntimestamp() { /bin/date '+%Y-%m-%d %H:%M:%S %z'; }\nlog() { echo \"[$(timestamp)] $*\"; }\n\nmask_secrets()\n{\n    /usr/bin/sed -E \\\n        -e 's/(gh[pousr]_)[A-Za-z0-9]{16,}/\\1***REDACTED***/g' \\\n        -e 's/(github_pat_)[A-Za-z0-9_]{16,}/\\1***REDACTED***/g' \\\n        -e 's#(https?://)[^/@[:space:]]+:[^/@[:space:]]+@#\\1***REDACTED-BASICAUTH***@#g' \\\n        -e 's/([Oo][Aa][Uu][Tt][Hh][_-]?[Tt][Oo][Kk][Ee][Nn][[:space:]]*[:=][[:space:]]*)[^[:space:]\"'\"'\"']+/\\1***REDACTED***/g' \\\n        -e 's/(\"?[Aa][Pp][Ii][_-]?[Kk][Ee][Yy]\"?[[:space:]]*[:=][[:space:]]*)[^[:space:],}]+/\\1***REDACTED***/g' \\\n        -e 's/([Pp]assword[[:space:]]*[:=][[:space:]]*)[^[:space:]\"'\"'\"']+/\\1***REDACTED***/g'\n}\n\ncapture_shell()\n{\n    local label=\"$1\" outfile=\"$2\" cmd=\"$3\"\n    { echo \"### $label\"; echo \"### shell: $cmd\"; echo \"### captured: $(timestamp)\"; echo; /bin/bash -c \"$cmd\" 2>&1; } \\\n        | mask_secrets > \"$outfile\"\n}\n\n###############################################################################\n# 01 - VERSION CHECK (informational -- cross-reference against known fix table)\n###############################################################################\n\nlog \"Checking installed Cursor version(s)...\"\n\n{\n    echo \"# Known fix versions for the CVEs this script checks for:\"\n    echo \"#   CVE-2025-54136 (MCPoison)            fixed in 1.3\"\n    echo \"#   CVE-2026-26268  (git hooks escape)     fixed in 2.5\"\n    echo \"#   CVE-2026-22708  (shell env poisoning)  fixed in 2.3\"\n    echo \"#   CVE-2026-50548/-50549 (DuneSlide)      fixed in 3.0\"\n    echo \"#   CVE-2026-63093  (Windows git.exe)      Windows-only, N/A here\"\n    echo \"# A version at/above the fix version means the CURRENT binary is\"\n    echo \"# not exploitable via that bug -- it says nothing about whether\"\n    echo \"# an attack happened while running an OLDER, vulnerable version\"\n    echo \"# before an update was applied. That's what the checks below are for.\"\n    echo\n    if [[ -f \"/Applications/Cursor.app/Contents/Resources/app/product.json\" ]]; then\n        /usr/bin/python3 -c \"\nimport json\nd = json.load(open('/Applications/Cursor.app/Contents/Resources/app/product.json'))\nprint('Installed version:', d.get('version'))\n\"\n    else\n        echo \"Cursor.app not found at the standard path.\"\n    fi\n} > \"$OUT/01_VERSION_CHECK/version.txt\"\n\n###############################################################################\n# 02 - CVE-2026-26268: malicious .git/hooks (strong evidence if present)\n###############################################################################\n\nlog \"Scanning every git repo for non-default, active git hooks...\"\n\nHOOKS_OUT=\"$OUT/02_GIT_HOOKS_CVE-2026-26268/findings.txt\"\n{\n    echo \"# Git ships hook files ending in .sample which are inactive by\"\n    echo \"# default. Any file here WITHOUT .sample is an ACTIVE hook that\"\n    echo \"# git will execute automatically at the relevant lifecycle point\"\n    echo \"# (pre-commit, post-checkout, post-merge, pre-push, etc).\"\n    echo \"# Custom hooks are rare in normal repos -- treat every hit below\"\n    echo \"# as worth reading in full.\"\n    echo\n} > \"$HOOKS_OUT\"\n\nwhile IFS= read -r -d '' HOOKDIR; do\n    for HOOK in \"$HOOKDIR\"/*; do\n        [[ -f \"$HOOK\" ]] || continue\n        [[ \"$HOOK\" == *.sample ]] && continue\n        {\n            echo \"==== ACTIVE HOOK: $HOOK ====\"\n            /usr/bin/stat -f '  modified: %Sm   accessed: %Sa   executable: %Sp' \"$HOOK\" 2>&1\n            REPO_DIR=\"$(/usr/bin/dirname \"$(/usr/bin/dirname \"$HOOKDIR\")\")\"\n            echo \"  repo: $REPO_DIR\"\n            echo \"  -- content --\"\n            /bin/cat \"$HOOK\" 2>&1\n            echo\n        } >> \"$HOOKS_OUT\"\n    done\ndone < <(/usr/bin/find /Users -maxdepth 9 -type d -path '*/.git/hooks' -not -path '*/node_modules/*' -print0 2>/dev/null)\n\nif ! /usr/bin/grep -q '^==== ACTIVE HOOK' \"$HOOKS_OUT\"; then\n    echo \"No active (non-.sample) git hooks found in any repo under /Users.\" >> \"$HOOKS_OUT\"\nfi\n\n###############################################################################\n# 03 - CVE-2025-54136 (MCPoison): mcp.json modification history\n###############################################################################\n\nlog \"Checking mcp.json files inside git repos for post-approval tampering...\"\n\nMCP_OUT=\"$OUT/03_MCP_HISTORY_CVE-2025-54136/findings.txt\"\n{\n    echo \"# The MCPoison attack requires a repo-committed mcp.json to be\"\n    echo \"# modified AFTER the developer already approved it once in Cursor.\"\n    echo \"# More than one commit touching the same mcp.json is not proof of\"\n    echo \"# attack (legitimate config changes happen), but is the exact\"\n    echo \"# pattern to manually review, especially whitespace-only diffs.\"\n    echo\n} > \"$MCP_OUT\"\n\nwhile IFS= read -r -d '' MCPFILE; do\n    REPO_DIR=\"$(/usr/bin/git -C \"$(/usr/bin/dirname \"$MCPFILE\")\" rev-parse --show-toplevel 2>/dev/null)\"\n    [[ -z \"$REPO_DIR\" ]] && continue\n    RELPATH=\"${MCPFILE#$REPO_DIR/}\"\n\n    {\n        echo \"==== $MCPFILE ====\"\n        echo \"  repo: $REPO_DIR\"\n        echo \"  -- commit history for this file --\"\n        /usr/bin/git -C \"$REPO_DIR\" log --follow --oneline -- \"$RELPATH\" 2>&1\n        COMMIT_COUNT=\"$(/usr/bin/git -C \"$REPO_DIR\" log --follow --oneline -- \"$RELPATH\" 2>/dev/null | /usr/bin/wc -l | /usr/bin/tr -d ' ')\"\n        echo \"  commit count touching this file: $COMMIT_COUNT\"\n        if [[ \"${COMMIT_COUNT:-0}\" -gt 1 ]]; then\n            echo \"  -- full diff history (review for post-approval command changes) --\"\n            /usr/bin/git -C \"$REPO_DIR\" log --follow -p -- \"$RELPATH\" 2>&1 | /usr/bin/head -300\n        fi\n        echo\n    } >> \"$MCP_OUT\"\ndone < <(/usr/bin/find /Users -maxdepth 8 -type f -iname 'mcp.json' -not -path '*/node_modules/*' -not -path '*/.vscode/extensions/*' -not -path '*/.cursor/extensions/*' -print0 2>/dev/null)\n\nif ! /usr/bin/grep -q '^====' \"$MCP_OUT\"; then\n    echo \"No git-tracked mcp.json files found under /Users.\" >> \"$MCP_OUT\"\nfi\n\n###############################################################################\n# 04 - CVE-2026-22708 / DuneSlide: behavioral traces (best-effort, weak signal)\n###############################################################################\n\nlog \"Best-effort scan for Cursor-spawned shell activity in unified log (last ${LOOKBACK_DAYS}d)...\"\n\ncapture_shell \"Unified log: exec-like events tied to Cursor/Cursor Helper processes\" \\\n    \"$OUT/04_BEHAVIORAL_CVE-2026-22708_DuneSlide/exec_events.txt\" \\\n    \"/usr/bin/log show --last ${LOOKBACK_DAYS}d --predicate '(process CONTAINS[c] \\\"Cursor\\\") AND (eventMessage CONTAINS[c] \\\"bash\\\" OR eventMessage CONTAINS[c] \\\"/bin/sh\\\" OR eventMessage CONTAINS[c] \\\"osascript\\\" OR eventMessage CONTAINS[c] \\\"curl\\\" OR eventMessage CONTAINS[c] \\\"child_process\\\")' --style compact 2>&1 | /usr/bin/head -5000\"\n\nlog \"Best-effort sweep of Cursor's local storage for suspicious command strings (noisy, low confidence)...\"\n\ncapture_shell \"Strings sweep of Cursor SQLite state stores for shell/exfil-looking patterns\" \\\n    \"$OUT/04_BEHAVIORAL_CVE-2026-22708_DuneSlide/local_storage_strings.txt\" \\\n    \"/usr/bin/find /Users/*/Library/'Application Support'/Cursor -maxdepth 6 -type f \\\\( -iname '*.vscdb' -o -iname '*.json' \\\\) -size -20M 2>/dev/null | while read -r f; do /usr/bin/strings \\\"\\$f\\\" 2>/dev/null | /usr/bin/grep -iE 'curl .*(-d|-F|-T)|base64 -d|/dev/tcp/|nc -e|reverse.?shell|wget .*\\\\|.*sh' | /usr/bin/sed \\\"s|^|[\\$f] |\\\"; done\"\n\n###############################################################################\n# 05 - CVE-2026-63093: Windows-only, trivial negative confirmation\n###############################################################################\n\nlog \"Confirming no Windows git.exe-style binary planting artifacts exist (N/A platform, sanity check only)...\"\n\ncapture_shell \"Search for any git.exe-named file anywhere under /Users (expected: none, this is macOS)\" \\\n    \"$OUT/05_WINDOWS_ONLY_CVE-2026-63093/check.txt\" \\\n    \"/usr/bin/find /Users -iname 'git.exe' 2>/dev/null || true\"\n\n###############################################################################\n# 06 - Cross-cutting: repos cloned from remotes outside the trusted org\n###############################################################################\n\nlog \"Listing git remotes outside the trusted org pattern '${TRUSTED_ORG}' (every CVE above requires a malicious/untrusted repo as the delivery vector)...\"\n\ncapture_shell \"Git remote URLs not matching '${TRUSTED_ORG}' -- review each manually\" \\\n    \"$OUT/06_UNTRUSTED_REPO_REMOTES/findings.txt\" \\\n    \"/usr/bin/find /Users -maxdepth 8 -type d -name .git -not -path '*/node_modules/*' -print0 2>/dev/null | while IFS= read -r -d '' g; do repo=\\$(/usr/bin/dirname \\\"\\$g\\\"); remotes=\\$(/usr/bin/git --git-dir=\\\"\\$g\\\" remote -v 2>/dev/null); echo \\\"\\$remotes\\\" | /usr/bin/grep -viq '${TRUSTED_ORG}' && [[ -n \\\"\\$remotes\\\" ]] && { echo \\\"== \\$repo ==\\\"; echo \\\"\\$remotes\\\"; echo; }; done\"\n\necho\necho \"====================================================================\"\necho \"CHECK COMPLETE\"\necho \"Output: $OUT\"\necho \"====================================================================\"\necho\necho \"Confidence summary:\"\necho \" - 02 (git hooks / CVE-2026-26268):        STRONG -- static artifact,\"\necho \"   any hit here needs immediate manual review.\"\necho \" - 03 (mcp.json history / CVE-2025-54136): STRONG -- static artifact,\"\necho \"   review any file with commit count > 1.\"\necho \" - 04 (CVE-2026-22708 / DuneSlide):        WEAK/BEST-EFFORT -- these\"\necho \"   are prompt-injection-driven behavioral exploits with no documented\"\necho \"   static signature. An empty result here does not clear the machine,\"\necho \"   it only means these specific queries found nothing.\"\necho \" - 05 (CVE-2026-63093):                    N/A on macOS, included for\"\necho \"   completeness only.\"\necho \" - 06 (untrusted remotes):                 every CVE above needs a\"\necho \"   malicious repo as the delivery vector -- anything flagged here is\"\necho \"   where you'd look for the actual injection point.\"\necho\necho \"Before sharing $OUT, spot-check a few files yourself to confirm\"\necho \"the redaction caught everything you'd consider sensitive.\"\n", "creation_timestamp": "2026-08-26T08:54:53.891678Z"}, {"uuid": "c8d2b4f5-f25e-4c64-a535-59ed3529b952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-22709", "type": "seen", "source": "https://gist.github.com/danisherror/2b3a74c36955599a919ce8731f06f8f5", "content": "# Docker, MicroVM & Sandbox \u2014 Curated Reading List\n \nA few of the sub-questions (architecture, networking, security, agents) share the same best sources, so those articles are repeated under each relevant question rather than forcing artificially different links.\n \n---\n \n## \ud83d\udc33 Docker\n \n### What is Docker / What is a container?\n- [What is Docker? \u2014 Docker Docs](https://docs.docker.com/get-started/docker-overview/)\n- [What Is Docker? \u2014 IBM](https://www.ibm.com/think/topics/docker)\n- [What is a Container? \u2014 Docker.com](https://www.docker.com/resources/what-container/)\n### Architecture of Docker\n- [Docker Architecture Explained with Diagram \u2014 PlacementPreparation.io](https://www.placementpreparation.io/blog/docker-architecture/)\n- [Docker Architecture Overview: Structure & Components \u2014 Spacelift](https://spacelift.io/blog/docker-architecture)\n- [Docker Architecture Explained: Components, Workflow, Diagram \u2014 PyNetLabs](https://www.pynetlabs.com/docker-architecture/)\n### Restricting outgoing traffic from a Docker container\n- [How to Restrict Outbound Traffic on a Docker Infrastructure \u2014 Medium (F. Ruty)](https://fruty.medium.com/how-to-restrict-outbound-traffic-on-a-docker-infrastructure-7effc45e313d)\n- [How to Set Up Docker Containers with Custom Firewall Rules (DOCKER-USER chain) \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-08-how-to-set-up-docker-containers-with-custom-firewall-rules/view)\n- [Docker: Restricting In- and Outbound Network Traffic \u2014 DEV Community](https://dev.to/andre/docker-restricting-in--and-outbound-network-traffic-67p)\n### Why / when to use Docker\n- [What Is Docker and Why Should You Use It [Containers 101] \u2014 Sematext](https://sematext.com/glossary/docker/)\n- [What is Docker? \u2014 GeeksforGeeks](https://www.geeksforgeeks.org/devops/introduction-to-docker/)\n### Advantages of Docker\n- [What is a Container? \u2014 Docker.com](https://www.docker.com/resources/what-container/) (standard/lightweight/secure benefits)\n- [Docker Architecture Overview \u2014 Spacelift](https://spacelift.io/blog/docker-architecture) (advantages & challenges section)\n### Disadvantages / gray areas of Docker\n- [21 Docker Security Best Practices: Daemon, Image, Containers \u2014 Spacelift](https://spacelift.io/blog/docker-security) (root-by-default, shared kernel, communication defaults)\n- [Docker Architecture and Its Components: Detailed Explanation \u2014 AlmaBetter](https://www.almabetter.com/bytes/articles/docker-architecture)\n- [MicroVM vs. Docker: A Trade-off Between Isolation and Lightness \u2014 InsForge](https://insforge.dev/blog/microvm-vs-docker) (soft kernel-boundary trade-off, i.e. the \"gray area\")\n### Security issues in Docker\n- [Top 7 Docker Security Risks and Best Practices \u2014 Chainguard](https://www.chainguard.dev/supply-chain-security-101/top-7-docker-security-risks-and-best-practices)\n- [9 Common Docker Container Security Vulnerabilities & Fixes \u2014 Aikido](https://www.aikido.dev/blog/docker-container-security-vulnerabilities)\n- [Docker Container Security Best Practices \u2014 Wiz](https://www.wiz.io/academy/container-security/docker-container-security-best-practices)\n### Advantages of running agents/models in Docker\n- [Running LLM Inference Safely with Docker Sandboxes and Model Runner \u2014 Medium (P. Madduri)](https://medium.com/@pavan4devops/running-llm-inference-safely-with-docker-sandboxes-and-model-runner-2dfc0b1f91c4)\n- [Docker Sandboxes: Run Claude Code and More Safely \u2014 Docker.com](https://www.docker.com/blog/docker-sandboxes-run-claude-code-and-other-coding-agents-unsupervised-but-safely/)\n- [\ud83d\ude80 Securely executing agent code in sandboxed Docker/E2B \u2014 Hugging Face (smolagents)](https://huggingface.co/posts/albertvillanova/674737128301579)\n### Disadvantages of running agents/models in Docker\n- [Running AI Coding Agents in Docker Sandboxes: Why Containers Are No Longer Enough \u2014 Medium (S. Zhukov)](https://xplicit.medium.com/running-ai-coding-agents-in-docker-sandboxes-why-containers-are-no-longer-enough-76e0f65f2ce5)\n- [Quantifying Frontier LLM Capabilities for Container Sandbox Escape (SandboxEscapeBench) \u2014 arXiv](https://arxiv.org/html/2603.02277)\n---\n \n## \ud83d\udd2c MicroVM\n \n### What is a MicroVM / MicroVM \"container\"\n- [What is AWS Firecracker? The microVM technology, explained \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker)\n- [Understanding Firecracker MicroVMs: The Next Evolution in Virtualization \u2014 Medium (Meziouni Reda)](https://medium.com/@meziounir/understanding-firecracker-microvms-the-next-evolution-in-virtualization-cb9eb8bbeede)\n- [What's the difference between a microVM and a container? \u2014 Northflank](https://northflank.com/blog/microvm-vs-container)\n### Architecture of a MicroVM\n- [firecracker/docs/design.md \u2014 GitHub (official design doc)](https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md)\n- [Firecracker Architecture Overview for Developers \u2014 DevelopNSolve](https://www.developnsolve.com/post/firecracker-architecture-overview)\n- [Architecture \u2014 Firecracker DeepWiki](https://deepwiki.com/firecracker-microvm/firecracker/3-architecture)\n### Restricting outgoing traffic from a MicroVM\n- [firecracker/docs/design.md \u2014 GitHub](https://github.com/firecracker-microvm/firecracker/blob/main/docs/design.md) (states Firecracker does no filtering itself \u2014 must be done at host level)\n- [Getting Started: Firecracker Network Setup \u2014 GitHub](https://github.com/firecracker-microvm/firecracker/blob/main/docs/getting-started.md) (TAP + iptables NAT/masquerade)\n- [AI Agent Code Execution Sandboxes on GPU Cloud: E2B, Daytona, and Firecracker Setup Guide \u2014 Spheron](https://www.spheron.network/blog/ai-agent-code-execution-sandbox-e2b-daytona-firecracker/) (per-sandbox iptables egress allowlisting)\n### Why / when to use a MicroVM\n- [When to use a micro VM, container or full VM \u2014 TechTarget](https://www.techtarget.com/searchitoperations/answer/When-to-use-a-micro-VM-container-or-full-VM)\n- [MicroVM vs Container: How the Kernel Boundary Changes Everything \u2014 Fly.io](https://fly.io/learn/microvm-vs-container/)\n### Advantages of MicroVMs\n- [What is AWS Firecracker? \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker) (speed, memory overhead, security stats)\n- [MicroVMs vs Containers: How to Isolate AI-Generated Code \u2014 Vercel](https://vercel.com/i/microvm-vs-container) (per-workload kernel, auditable containment)\n### Disadvantages of MicroVMs\n- [What is AWS Firecracker? \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker) (no live migration, Linux-only guests, needs bare-metal/nested virtualization)\n- [MicroVM vs Container: How the Kernel Boundary Changes Everything \u2014 Fly.io](https://fly.io/learn/microvm-vs-container/) (operational complexity, debugging difficulty)\n### Gray areas in MicroVMs\n- [Am I in a container or a microVM? \u2014 Some Natalie's Corner of the Internet](https://some-natalie.dev/blog/microvm-or-container/) (hard to tell from the inside; blurred boundary with \"shim\" runtimes)\n- [MicroVM vs. Docker: A Trade-off Between Isolation and Lightness \u2014 InsForge](https://insforge.dev/blog/microvm-vs-docker) (increasingly common to nest containers inside microVMs)\n### Security issues in MicroVMs\n- [Firecracker vs gVisor: Which isolation technology should you use? \u2014 Northflank](https://northflank.com/blog/firecracker-vs-gvisor)\n- [Kata, gVisor, or Firecracker? Container Isolation Guide \u2014 Edera](https://edera.dev/stories/kata-vs-firecracker-vs-gvisor-isolation-compared)\n- [Firecracker, gVisor, and Micro-VMs: The Building Blocks \u2014 StealthCloud](https://stealthcloud.ai/cloud-paradigms/firecracker-gvisor-micro-vms/)\n### Advantages of running agents/models in a MicroVM\n- [Firecracker, gVisor, Containers, and WebAssembly \u2014 Comparing Isolation Technologies for AI Agents \u2014 SoftwareSeni](https://www.softwareseni.com/firecracker-gvisor-containers-and-webassembly-comparing-isolation-technologies-for-ai-agents/)\n- [Running AI agents safely in a microVM using docker sandbox \u2014 Andrew Lock](https://andrewlock.net/running-ai-agents-safely-in-a-microvm-using-docker-sandbox/)\n- [Secure CI/CD Isolation with Firecracker and WireGuard \u2014 Medium (acarlini)](https://medium.com/@antonvkrylov/secure-ci-cd-isolation-with-firecracker-and-wireguard-2df3aef6c64a)\n### Disadvantages of running agents/models in a MicroVM\n- [Kata Containers vs Firecracker vs gVisor \u2014 Northflank](https://northflank.com/blog/kata-containers-vs-firecracker-vs-gvisor) (orchestration/engineering overhead, startup-latency tradeoffs)\n- [The Serverless Computing Survey: A Technical Primer \u2014 arXiv](https://arxiv.org/pdf/2112.12921) (startup latency >1000ms in heavier VM-based isolation, limited flexibility)\n---\n \n## \ud83d\udce6 Sandbox\n \n### What is a Sandbox\n- [Sandbox (computer security) \u2014 Wikipedia](https://en.wikipedia.org/wiki/Sandbox_(computer_security))\n- [Fundamentals of Sandboxing \u2014 Baeldung on Computer Science](https://www.baeldung.com/cs/sandboxing-fundamentals)\n- [What Is a Sandbox in Cybersecurity? Sandboxing Explained for Security Teams \u2014 Appsecure](https://www.appsecure.security/blog/what-is-sandbox-cybersecurity)\n### Architecture of a Sandbox\n- [What Is Sandboxing? What Are the Principles of Sandboxing? \u2014 Huawei](https://info.support.huawei.com/info-finder/encyclopedia/en/Sandboxing.html) (system-level vs. container-level sandbox architecture)\n- [Sandboxing \u2014 Virtualization glossary \u2014 FS.com](https://www.fs.com/glossary/sandboxing-g350.html) (virtualization + access control + anti-evasion components)\n- [Fundamentals of Sandboxing \u2014 Baeldung](https://www.baeldung.com/cs/sandboxing-fundamentals) (surveys different sandbox architectures)\n### Restricting outgoing traffic from a Sandbox\n- [AI Agent Code Execution Sandboxes on GPU Cloud: E2B, Daytona, and Firecracker Setup Guide \u2014 Spheron](https://www.spheron.network/blog/ai-agent-code-execution-sandbox-e2b-daytona-firecracker/) (per-sandbox NAT + iptables egress allowlist)\n- [AI Agent Sandboxing in 2026: Docker, E2B, Firecracker, gVisor, Modal & Daytona Compared \u2014 amux](https://amux.io/guides/ai-agent-sandboxing/) (disabling outbound networking / allowlisting as mitigation)\n### Why / when to use a Sandbox\n- [What Is Sandboxing? \u2014 Palo Alto Networks](https://www.paloaltonetworks.com/cyberpedia/sandboxing)\n- [What is Sandboxing? Understand Sandboxing in Cyber Security \u2014 OPSWAT](https://www.opswat.com/blog/what-is-sandboxing)\n### Advantages of a Sandbox\n- [What Is Sandboxing? \u2014 Palo Alto Networks](https://www.paloaltonetworks.com/cyberpedia/sandboxing) (supports zero trust, reduces patch urgency, protects BYOD)\n- [What is Sandboxing? \u2014 OPSWAT](https://www.opswat.com/blog/what-is-sandboxing) (dynamic/behavioral detection beyond signatures)\n### Disadvantages of a Sandbox\n- [What Is Sandboxing in Cybersecurity? Detecting Threats \u2014 SentinelOne](https://www.sentinelone.com/cybersecurity-101/endpoint-security/what-is-sandboxing/) (time-window limits, can't simulate human interaction)\n- [Sandbox Evasion: How Attackers Use It to Bypass Malware Detection \u2014 Group-IB](https://www.group-ib.com/resources/knowledge-hub/sandbox-evasion/) (ineffective vs. novel/zero-day exploits, resource/time constraints)\n### Gray areas in Sandboxing\n- [Malware Dynamic Analysis Evasion Techniques: A Survey \u2014 arXiv](https://arxiv.org/pdf/1811.01190) (malware simply \"behaves nicely\" inside the sandbox \u2014 detection blind spot)\n- [Navigating the Vast Ocean of Sandbox Evasions \u2014 Unit 42 (Palo Alto)](https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection/) (in-guest vs. out-of-guest instrumentation trade-offs)\n### Security issues in a Sandbox\n- [Malware Sandbox Evasion Techniques \u2014 Apriorit](https://www.apriorit.com/dev-blog/545-sandbox-evading-malware)\n- [Malware Sandbox Evasion Techniques: How Threats Slip Past Detection \u2014 VMRay](https://www.vmray.com/sandbox-evasion-techniques/)\n- [What Is Sandboxing in Cybersecurity? Detecting Threats \u2014 SentinelOne](https://www.sentinelone.com/cybersecurity-101/endpoint-security/what-is-sandboxing/) (MITRE ATT&CK T1497 sandbox-evasion techniques)\n### Advantages of running agents/models in a Sandbox\n- [AI Agent Sandbox: How to Safely Run Autonomous Agents in 2026 \u2014 Firecrawl](https://www.firecrawl.dev/blog/ai-agent-sandbox)\n- [Coding Agent Sandbox: Secure Environments for AI-Generated Code \u2014 Bunnyshell](https://www.bunnyshell.com/guides/coding-agent-sandbox/)\n- [Where Should Your AI Agent Run Code: E2B vs Daytona vs Modal vs Cloudflare vs Vercel Sandbox \u2014 Developers Digest](https://www.developersdigest.tech/blog/ai-agent-code-sandbox-comparison-2026)\n### Disadvantages of running agents/models in a Sandbox\n- [Modal vs E2B vs Daytona vs Vercel Sandbox: AI Code Execution \u2014 Particula](https://particula.tech/blog/modal-vs-e2b-vs-daytona-vs-vercel-sandbox-ai-code-execution) (isolation vs. cold-start latency trade-offs; \"capability-permissions layer everyone forgets\" \u2014 sandboxing the process isn't the same as scoping what damage a compromised agent can do)\n- [AI Agent Sandboxing in 2026 \u2014 amux](https://amux.io/guides/ai-agent-sandboxing/) (container escapes like CVE-2024-21626 still possible if isolation tech is chosen poorly)\n---\n \n*Note: Several sources (e.g., Northflank's blog, Firecracker's own docs, and Spheron's guide) are reused across multiple questions because they directly and thoroughly address more than one sub-topic \u2014 this was intentional rather than a lack of variety.*\n \n---\n---\n \n# Part 2 \u2014 Deeper Dives & Related Topics\n \n## \u2696\ufe0f Comparative / Decision-Making\n \n### Docker vs MicroVM vs Sandbox vs Full VM comparison\n- [Containers vs Virtual Machines: Key Differences and When to Use Each (2026) \u2014 Northflank](https://northflank.com/blog/containers-vs-virtual-machines)\n- [Comparing Sandboxing Approaches for AI Agents \u2014 Docker](https://www.docker.com/blog/comparing-sandboxing-approaches-ai-agents/)\n- [MicroVMs vs Containers: How to Isolate AI-Generated Code \u2014 Vercel](https://vercel.com/i/microvm-vs-container)\n### How to choose the right isolation layer (cost vs security vs latency)\n- [Docker Sandboxes and microVMs, Explained \u2014 InfoWorld](https://www.infoworld.com/article/4177309/docker-sandboxes-and-microvms-explained.html)\n- [MicroVM vs Container: How the Kernel Boundary Changes Everything \u2014 Fly.io](https://fly.io/learn/microvm-vs-container/)\n- [microsandbox vs Docker: MicroVMs vs Containers for Agents \u2014 microsandbox.dev](https://microsandbox.dev/compare/docker)\n### Kata Containers vs gVisor vs Firecracker (deep technical comparison)\n- [Kata, gVisor, or Firecracker? Container Isolation Guide \u2014 Edera](https://edera.dev/stories/kata-vs-firecracker-vs-gvisor-isolation-compared)\n- [Kata Containers vs Firecracker vs gVisor \u2014 Northflank](https://northflank.com/blog/kata-containers-vs-firecracker-vs-gvisor)\n- [Firecracker vs gVisor: Which Sandbox in 2026? \u2014 Aleksei Aleinikov](https://www.alekseialeinikov.com/en/blog/topics/devops/microvms-firecracker-vs-gvisor-secure-workloads-2026)\n### Cost of running each at scale\n- [microVM vs. Docker: A Trade-off Between Isolation and Lightness \u2014 InsForge](https://insforge.dev/blog/microvm-vs-docker)\n- [Firecracker, gVisor, Containers, and WebAssembly \u2014 Comparing Isolation Technologies for AI Agents \u2014 SoftwareSeni](https://www.softwareseni.com/firecracker-gvisor-containers-and-webassembly-comparing-isolation-technologies-for-ai-agents/) (10\u201320% cost premium for microVMs at scale)\n---\n \n## \ud83d\udc33 Docker \u2014 Deeper Dives\n \n### Docker networking modes (bridge, host, overlay, macvlan)\n- [Docker Networking Explained: Overlay & Macvlan Networks \u2014 Eduonix](https://blog.eduonix.com/2026/07/docker-networking-explained-bridge-host-overlay-macvlan/)\n- [Docker Networking \u2014 Bridge, Host, Overlay & Macvlan Drivers \u2014 NetworkersHome](https://www.networkershome.com/fundamentals/kubernetes-networking/docker-networking/)\n- [Docker Networking Deep Dive: Bridge, Host, Overlay, and Macvlan Explained \u2014 usulnet](https://articles.usulnet.com/articles/docker-networking-explained)\n### Docker volumes & persistent storage strategies\n- [Docker Volumes vs. Docker Layers: Understanding Persistent Storage and Image Optimization \u2014 What's in the Cloud](https://whatsinthecloud.substack.com/p/docker-volumes-vs-docker-layers-understanding)\n- [Docker for Developers: Essential Guide to Portable Environments and Multi-Stage Builds \u2014 Dev|Journal](https://earezki.com/ai-news/2026-03-28-docker-for-developers-the-practical-guide-you-actually-need/)\n### Multi-stage builds & image size optimization\n- [How to Optimize Docker Images with Multi-Stage Builds \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-20-docker-multi-stage-builds/view)\n- [Docker Multi-Stage Builds for Production-Optimized Images \u2014 dasroot.net](https://dasroot.net/posts/2026/04/docker-multi-stage-builds-production-optimized-images/)\n- [6 Proven Ways to Shrink Your Docker Image Size \u2014 BestHub](https://www.besthub.dev/articles/6-proven-ways-to-shrink-your-docker-image-size-9a060eb748d6)\n### Rootless Docker \u2014 how it works and its limitations\n- [Docker Rootless: High Security and High Performance \u2014 DEV Community](https://dev.to/jiisanda/docker-rootless-high-security-and-high-performance-2ji8)\n- [Rootless Docker and Its Hidden Security Trade-Offs \u2014 Ken Muse](https://www.kenmuse.com/blog/rootless-docker-and-its-hidden-security-trade-offs/)\n- [How to Run Docker Without Root (Rootless Mode) \u2014 OneUptime](https://oneuptime.com/blog/post/2026-01-06-docker-rootless-mode/view)\n### Docker Compose vs Kubernetes \u2014 when you've outgrown Compose\n- [Docker Compose vs Kubernetes: When to Use Each in 2026 \u2014 DEV Community](https://dev.to/_d7eb1c1703182e3ce1782/docker-compose-vs-kubernetes-when-to-use-each-in-2026-1hji)\n- [When to Use Docker Compose vs. Kubernetes \u2014 Earthly Blog](https://earthly.dev/blog/dockercompose-vs-k8s/)\n- [Docker Compose vs Kubernetes \u2014 Spacelift](https://spacelift.io/blog/docker-compose-vs-kubernetes)\n### Container orchestration basics (Kubernetes, Swarm, Nomad)\n- [Kubernetes vs Docker Explained: Container Orchestration Basics \u2014 Wiz](https://www.wiz.io/academy/container-security/kubernetes-and-docker)\n- [Docker Compose vs Kubernetes: Which in 2026? \u2014 DeployWise](https://deploywise.dev/blog/docker-compose-vs-kubernetes) (covers Swarm's decline vs. Kubernetes standardization)\n### Image signing, SBOMs, and supply chain security (Sigstore, cosign)\n- [\ud83d\udd0f SBOM and Container Signing for Cloud Supply Chain \u2014 ServerMall Cloud](https://cloud.servermall.com/blog/sbom-and-container-image-signing-cosign-sigstore-and-supply-chain-security-in-the-cloud/)\n- [How to Implement Supply Chain Security for Kubernetes \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-20-supply-chain-security-kubernetes/view)\n- [Sign Container Images with Sigstore Cosign \u2014 Kubezilla](https://kubezilla.io/sign-container-images-with-sigstore-cosign/)\n### cgroups and resource limiting in depth (CPU/memory/pids-limit)\n- [How to Understand Docker Container Cgroups in Depth \u2014 OneUptime](https://oneuptime.com/blog/post/2026-02-08-how-to-understand-docker-container-cgroups-in-depth/view)\n- [Linux cgroups: Resource Limits for Processes \u2014 Abhik Sarkar](https://www.abhik.ai/concepts/systems/cgroups)\n- [cgroups Explained \u2014 How Linux Limits Container Resources \u2014 Tuteworld](https://www.tuteworld.com/linux/containers/cgroups/)\n---\n \n## \ud83d\udd2c MicroVM \u2014 Deeper Dives\n \n### Kata Containers architecture & Kubernetes integration\n- [Kata Containers Architecture \u2014 Official Docs](https://kata-containers.github.io/kata-containers/design/architecture/)\n- [Kubernetes Integration \u2014 Kata Containers DeepWiki](https://deepwiki.com/kata-containers/kata-containers/4.2-kubernetes-integration)\n- [Kata Containers on Kubernetes and Kata Firecracker VMM Support \u2014 Medium (Gokul Chandra)](https://gokulchandrapr.medium.com/kata-containers-on-kubernetes-and-kata-firecracker-vmm-support-28abb3a196e7)\n### Snapshot/resume & \"warm pool\" strategies for cold-start latency\n- [Restoring Uniqueness in MicroVM Snapshots \u2014 arXiv](https://arxiv.org/pdf/2102.12892)\n- [firecracker/docs/snapshotting/snapshot-support.md \u2014 GitHub](https://github.com/firecracker-microvm/firecracker/blob/main/docs/snapshotting/snapshot-support.md)\n- [Building an AWS Lambda-like Runtime with Firecracker MicroVMs \u2014 Medium (Vivek Jadhav)](https://medium.com/@vivek1502/building-an-aws-lambda-like-runtime-with-firecracker-microvms-42a418c6e3d7)\n### Confidential computing / TEEs (AMD SEV, Intel TDX) with microVMs\n- [How to Sandbox AI Agents in 2026: Firecracker, gVisor, Runtimes & Isolation Strategies \u2014 Manveer Chawla](https://manveerc.substack.com/p/ai-agent-sandboxing-guide) (covers confidential-computing \"Level 5\" isolation)\n- [AMD SEV vs Intel TDX vs NVIDIA GPU TEE \u2014 Phala](https://phala.com/learn/AMD-SEV-vs-Intel-TDX-vs-NVIDIA-GPU-TEE)\n- [Confidential VMs Explained: An Empirical Analysis of AMD SEV-SNP and Intel TDX \u2014 ACM](https://dl.acm.org/doi/10.1145/3700418)\n### Unikernels as an alternative/complement to microVMs\n- [Unikernels vs. Containers: See the Lightweight Championship Fight \u2014 TechTarget](https://www.techtarget.com/searchitoperations/tip/Unikernels-vs-containers-See-the-lightweight-championship-fight)\n- [Containers vs. Unikernels: An Apples-to-Oranges Comparison \u2014 Container Journal](https://containerjournal.com/topics/container-ecosystems/containers-vs-unikernels-an-apples-to-oranges-comparison/)\n- [Hands-On Introduction to Unikernels \u2014 Ivan Velichko (X thread)](https://x.com/iximiuz/status/2012214348672844149)\n### How AWS Lambda/Fargate use Firecracker under the hood\n- [What is AWS Firecracker? The microVM Technology, Explained \u2014 Northflank](https://northflank.com/blog/what-is-aws-firecracker)\n- [Firecracker microVMs: The Power Behind AWS Lambda \u2014 Antho's Blog](https://www.anthony-balitrand.fr/2025/08/12/firecracker-microvms-the-power-behind-aws-lambda/)\n- [AWS Lambda MicroVMs: Sandbox Agent Code Without the Infra \u2014 AgentConn](https://agentconn.com/blog/sandbox-agent-code-aws-lambda-firecracker-microvms-2026/)\n### GPU passthrough into microVMs (for AI inference workloads)\n- [Best Self-Hosted MicroVM Platforms 2026: Firecracker vs Cloud-Hypervisor vs crosvm \u2014 Pi Stack](https://www.pistack.xyz/posts/2026-05-09-microvm-platforms-firecracker-cloud-hypervisor-crosvm-guide/)\n- [A Field Guide to Sandboxes for AI \u2014 Luis Cardoso](https://www.luiscardoso.dev/blog/sandboxes-for-ai) (VFIO passthrough trade-offs)\n- [A Journey to Support vGPU in Firecracker \u2014 SlideShare](https://www.slideshare.net/slideshow/ajournneytosupportvgpuinfirecrackerpdf/252009037)\n---\n \n## \ud83d\udce6 Sandbox \u2014 Deeper Dives\n \n### OS-level sandboxing primitives: seccomp, AppArmor, SELinux, Landlock\n- [Securing Linux with SELinux (or AppArmor) \u2014 LinuxBlog.io](https://linuxblog.io/securing-linux-selinux-apparmor/)\n- [Landlock LSM: Toward Unprivileged Sandboxing \u2014 LWN.net](https://lwn.net/Articles/731478/)\n- [Locking Down Science Gateways with Landlock and Seccomp \u2014 arXiv](https://arxiv.org/html/2509.18548v2) (direct comparison of all four primitives)\n### Browser sandboxing (site isolation, Chrome's multi-process model)\n- [Chromium Docs \u2014 Process Model and Site Isolation](https://chromium.googlesource.com/chromium/src/+/main/docs/process_model_and_site_isolation.md)\n- [Site Isolation \u2014 Chromium.org](https://www.chromium.org/Home/chromium-security/site-isolation/)\n- [Chrome Sandbox Mode Explained \u2014 ChromeThemer](https://www.chromethemer.com/chrome-sandbox-mode-explained/)\n### WebAssembly (Wasm) as a sandboxing technology \u2014 strengths/limits vs containers\n- [Wasm vs. Containers: A Security and Performance Comparison \u2014 Medium (Enrico Piovesan)](https://medium.com/wasm-radar/wasm-vs-containers-a-security-and-performance-comparison-bbb0bd35c3fb)\n- [WebAssembly (Wasm) in the Cloud: The Next Stage After Containers? \u2014 ayedo](https://ayedo.de/en/posts/webassembly-wasm-in-der-cloud-die-nachste-stufe-nach-dem-container/)\n- [WebAssembly vs Containers: Stateless Compute Boundary \u2014 candede.com](https://www.candede.com/articles/wasm-vs-docker/) (honest take on where Wasm's sandbox model still needs defense-in-depth)\n### Language-level sandboxes (Python, JS vm2/isolated-vm)\n- [vm2 Sandbox Escape | AI Agent RCE Risk and IOCs \u2014 Kodem](https://www.kodemsecurity.com/resources/vm2-sandbox-escape-vulnerabilities-the-2026-cve-wave-turning-ai-agents-into-host-rce-vectors)\n- [Critical Flaw in isolated-vm Can Lead to Sandbox Escape, RCE Threat \u2014 DevOps.com](https://devops.com/critical-flaw-in-isolated-vm-can-lead-to-sandbox-escape-rce-threat/)\n- [New Sandbox Escape Affecting Popular Node.js Sandbox Library vm2 \u2014 Semgrep](https://semgrep.dev/blog/2026/calling-back-to-vm2-and-escaping-sandbox/) (also recommends alternatives: isolated-vm, Deno, containers)\n### Persistent vs ephemeral sandboxes for long-running AI agents\n- [AI Agent Sandboxing in 2026: Docker, E2B, Firecracker, gVisor, Modal & Daytona Compared \u2014 amux](https://amux.io/guides/ai-agent-sandboxing/) (Daytona's persistent workspaces vs. E2B's short-lived execution)\n- [Where Should Your AI Agent Run Code: E2B vs Daytona vs Modal vs Cloudflare vs Vercel Sandbox \u2014 Developers Digest](https://www.developersdigest.tech/blog/ai-agent-code-sandbox-comparison-2026)\n### Sandbox escape write-ups (real-world breakouts)\n- [Critical Sandbox Escape in vm2 Enables RCE \u2014 Endor Labs](https://www.endorlabs.com/learn/cve-2026-22709-critical-sandbox-escape-in-vm2-enables-arbitrary-code-execution)\n- [Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE \u2014 The Hacker News](https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html)\n- [Quantifying Frontier LLM Capabilities for Container Sandbox Escape (SandboxEscapeBench) \u2014 arXiv](https://arxiv.org/html/2603.02277)\n---\n \n## \ud83e\udd16 AI-Agent-Specific Topics\n \n### Permission/capability models for agentic tool-calling\n- [Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk \u2014 NVIDIA Technical Blog](https://developer.nvidia.com/blog/practical-security-guidance-for-sandboxing-agentic-workflows-and-managing-execution-risk/)\n- [AI Agent Security \u2014 OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html)\n- [Small Language Models for Agentic Systems: A Survey (Section XV \u2014 Security, Governance & Compliance for Tool-Using Agents) \u2014 arXiv](https://arxiv.org/pdf/2510.03847)\n### Prompt-injection-driven sandbox escape \u2014 is isolation alone enough?\n- [When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks \u2014 Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/)\n- [Agent Security Boundaries: From Prompt Injection to Tool Misuse \u2014 Medium (Tao An)](https://tao-hpu.medium.com/agent-security-boundaries-from-prompt-injection-to-tool-misuse-d25b6dbaad60)\n- [AI Agent Code Execution Security Explained: Why It Happens and How to Fix It \u2014 PredictionGuard](https://predictionguard.com/blog/ai-agent-code-execution-security-explained)\n### Comparing built-in agent sandboxes: Claude Code, Codex CLI, Cursor, Gemini CLI\n- [Claude Code vs Codex CLI vs Gemini CLI (2026) \u2014 CodeAnt](https://codeant.ai/blogs/claude-code-cli-vs-codex-cli-vs-gemini-cli-best-ai-cli-tool-for-developers-in-2025)\n- [Claude Code vs Gemini CLI vs Codex CLI: Which One Should You Pick in 2026? \u2014 ShareUHack](https://www.shareuhack.com/en/posts/claude-code-vs-gemini-cli-vs-codex-cli-decision-guide-2026)\n- [Coding Agent Sandbox: Secure Environments for AI-Generated Code \u2014 Bunnyshell](https://www.bunnyshell.com/guides/coding-agent-sandbox/) (Bubblewrap/Seatbelt/Landlock+seccomp comparison across agents)\n### Multi-agent isolation \u2014 should each agent get its own sandbox/microVM?\n- [The Best-Laid SCHEMEs: Coordinated Sabotage and Monitoring in Multi-Agent Systems \u2014 arXiv](https://arxiv.org/pdf/2605.29178) (per-agent Linux users sharing one sandbox vs. full isolation)\n- [What Is an Agent Execution Sandbox? \u2014 Augment Code](https://www.augmentcode.com/guides/agent-execution-sandbox)\n- [Multi-Agent Penetration Testing AI for the Web \u2014 arXiv](https://arxiv.org/pdf/2508.20816) (shared-container vs. per-agent isolation trade-offs)\n### Observability/auditing inside a sandboxed agent run\n- [7 Best AI Agent Observability Tools for Coding Teams in 2026 \u2014 Augment Code](https://www.augmentcode.com/tools/best-ai-agent-observability-tools)\n- [AI Agent Sandbox Environment - Setup Guide 2026 \u2014 Fastio](https://fast.io/resources/ai-agent-sandbox-environment/)\n- [AI Sandboxes & Volumes: Isolated Environments for Coding Agents \u2014 Windmill](https://www.windmill.dev/blog/launch-week-ai-sandboxes)\n### Data exfiltration risks for agents with file + network access\n- [How to Sandbox AI Agents in 2026: MicroVMs, gVisor & Isolation Strategies \u2014 Northflank](https://northflank.com/blog/how-to-sandbox-ai-agents)\n- [Exploiting Web Search Tools of AI Agents for Data Exfiltration \u2014 arXiv](https://arxiv.org/pdf/2510.09093)\n- [Practical Security Guidance for Sandboxing Agentic Workflows and Managing Execution Risk \u2014 NVIDIA Technical Blog](https://developer.nvidia.com/blog/practical-security-guidance-for-sandboxing-agentic-workflows-and-managing-execution-risk/) (egress controls as the #1 mitigation)\n ", "creation_timestamp": "2026-08-31T03:55:42.293307Z"}, {"uuid": "d6db7aff-24c4-4b92-886b-64bab13cb222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22709", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv3b5bz2b32t", "content": "CVE-2026-22709 - vm2\nAn attacker can escape the sandbox and run arbitrary code on a server running an out-of-date version of vm2 for Node.js. This could allow unauthorized access or data theft. Update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-09-09T09:50:04.317145Z"}, {"uuid": "4f13b8f9-ba0c-4a2b-b5e1-3de0497ae811", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22706", "type": "seen", "source": "Telegram/DdYTYSDe8lvqixn7SsuHC2cVYP8OwvHWnrdarY89A6zETG4", "content": "", "creation_timestamp": "2026-09-14T03:00:15.185120Z"}, {"uuid": "98b51701-65ad-43df-a895-df01d977357e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22706", "type": "published-proof-of-concept", "source": "Telegram/DdYTYSDe8lvqixn7SsuHC2cVYP8OwvHWnrdarY89A6zETG4", "content": "", "creation_timestamp": "2026-09-15T00:00:21.156652Z"}, {"uuid": "f2fb0fb4-f775-4d7e-881f-ee05773b64a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2270", "type": "seen", "source": "https://bsky.app/profile/kubernetes.dev/post/3mwdsylen6l2b", "content": "CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation -", "creation_timestamp": "2026-09-25T12:56:03.846207Z"}, {"uuid": "2b1d4a88-02ae-4f58-991e-2eec93a03bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2270", "type": "seen", "source": "https://bsky.app/profile/kubernetes.io/post/3mwe2b2d7np2m", "content": "CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation -", "creation_timestamp": "2026-09-25T15:06:04.262370Z"}]}