Three agent sandbox failures, three different places control was lost

A contained AI worker can still have too much authority inside its guest. A command service can be exposed outside its intended network. A retrieved web page can be treated as a program instruction when an assistant has unrestricted shell tools. All are relevant to agent containment, but none automatically establishes escape to the physical host.

Two Kata Containers fixes illustrate different mistakes at the process-launch boundary. In the rustjail capability issue, a process could influence the procfs view from which a capability ceiling was derived. The repair uses a kernel capability query, PR_CAPBSET_READ, and tighter namespace handling rather than trusting the mutable pseudo-filesystem value. An incorrect ceiling could leave excessive privilege inside the guest.

In the working-directory issue, procfs magic-link behavior let a newly rooted process retain a current directory beyond its intended container root. The repair rejects an inaccessible or escaped working directory after a root transition. These are distinct primitives. The reported affected root is the guest environment, not independently demonstrated access to the physical machine that hosts it.

OpenHands agent-server exposed command-capable HTTP or WebSocket functionality when ports were published too broadly without effective session authentication. The repaired SDK narrows binding and requires keys in the relevant session path. This is a conventional service-reachability and caller-authorization defect in software used to run agents. A successful call would act with the sandbox server's privileges; that is not itself a host-kernel breakout.

A LangAlpha advisory alleges that untrusted retrieved web text can redirect an agent equipped with unrestricted Bash or ExecuteCode tools. The public record here is an unreviewed vulnerability report, not verified production exploitation. It still identifies a familiar separation: a web page is data, while invoking a shell is a privileged effect that requires independently established user authority.

Ask which specific resource the worker could access before and after the fault: guest files, published network ports, process capabilities, external services or host resources. Then ask which independent guard checked that access. A log saying "agent escaped" without naming this boundary is too imprecise to guide remediation.

The capability patch, directory patch, OpenHands repair and LangAlpha advisory substantiate different failure paths and different evidence maturity. They should not be merged into a universal agent sandbox escape rate.