Sandbox gaps: 16% of MCP servers hold filesystem powers your agent sandbox doesn't cover
SirRobinBlibs · reddit · 2026-10-30
The author shows that coding-agent sandboxes by default don't cover MCP servers: Claude Code lists local MCP servers among processes running "with your full access," and Codex notes MCP servers use their own process or transport.
- A paper (arXiv 2610.22301) dubs this "filesystem capability laundering": a narrow tool can be steered via agent-picked arguments from untrusted content into reading files outside its job. The reference Git server's gitadd allowed ../../.ssh/ided25519 to be staged and diffed out (CVE-2026-27735, fixed in mcp-server-git).
- Numbers: 787 of 4,806 screened servers (16.4%) are non-filesystem servers with filesystem capabilities (coarse signal); dynamic tests confirmed 150 instances and 13 advisories, all blocked by OS-level sandbox policies.
Mitigations: containerize read-only servers (--network none, :ro mount, digest-pinned image); give each server its own narrow token via env, using CLAUDECODESUBPROCESSENVSCRUB=1 in Claude Code; sandbox the whole agent; and patch the Python mcp SDK (GHSA-84m7-p3x7-pcfv, fixed in 1.30.0/2.2.0).
More from coding & agent
- This Creator Runs His Entire X Content Loop With 6 Agents on Grok and Typefully — VibeMarketer_ · 2026-10-30
- Weaviate: Use Slow-Query Log and Profiling to Fix Slow Hybrid Search Queries — CShorten30 · 2026-10-30
- Open Duet: Open-Source Self-Hosted Rival to Claude Duet Hits 6.3k GitHub Stars — matchaman11 · 2026-10-30
- OpenClaw's Trail of Bits audit confirms 23 vulnerabilities, all fixed — steipete · 2026-10-30
- Supabase hits 13M users as ~70% of new activity comes from AI agents — ycombinator · 2026-10-30
- Zero evals is fine at first: nail UX, then build evals with domain experts — Al_Grigor · 2026-10-30