Cursor Auto-Run Sandbox Escape via Privileged Dev Container Mount

Technical Analysis

The Auto-Run Sandbox feature is meant to constrain autonomous agent actions (e.g., shell commands, file edits) so they cannot silently affect the host system. Because the sandbox trust boundary did not account for Docker Desktop/Dev Containers CLI as an escalation path, an agent could invoke container tooling to spin up a privileged container that mounts virtiofs0, the virtio-fs share Docker Desktop uses to bridge host and VM filesystems on macOS. Mounting this device from inside a privileged container exposes the host's home directory to the container, and combined with privileged mode, allows arbitrary host command execution under the user's identity. The entry point is the agent's own tool-invocation capability (auto-run shell/container commands) rather than an external attacker directly; the risk is that a compromised, misconfigured, or maliciously prompted agent can silently escalate from sandboxed code execution to full host compromise, crossing the tool/sandbox boundary without triggering an additional permission prompt.

Affected Systems

Cursor IDE

Detection Signatures

• Agent-initiated docker run commands with --privileged flag originating from Auto-Run Sandbox sessions
• Container mount operations referencing virtiofs0 or Docker Desktop VM shares
• Unexpected Dev Containers CLI invocations triggered by AI agent auto-run without explicit user prompt
• Host home directory access patterns correlated with container lifecycle events initiated by IDE agent processes

Remediation Steps

1. 1

   Upgrade Cursor IDE

   Update to Cursor 3.0.0 or later, which fixes the sandbox escape by properly restricting privileged container operations from Auto-Run agent sessions.

2. 2

   Restrict Docker/Dev Containers availability

   On systems running older Cursor versions, avoid having Docker Desktop and the Dev Containers CLI installed alongside Auto-Run Sandbox mode, or disable Auto-Run until patched.

3. 3

   Enforce permission prompts for privileged operations

   Configure or verify that any container launch with --privileged or virtiofs mount operations require explicit user confirmation, independent of agent auto-run settings.

4. 4

   Audit agent tool permissions

   Review which host-level tools (Docker, container runtimes) are exposed to AI coding agents and apply least-privilege scoping to prevent silent escalation paths.

5. 5

   Monitor container and mount activity

   Deploy host-based monitoring for privileged container launches and virtiofs mount events correlated with IDE agent processes.