Systematization of Execution-Security Gaps in AI Coding Agent Sandboxes (Isolation, Access Control, TOCTOU)
First seen Jul 8, 2026 · Updated Jul 8, 2026
This is an academic survey (SoK) that reviews and categorizes 39 existing papers on execution-layer security for AI coding agents, rather than describing a novel exploit or active campaign. It highlights systemic weaknesses across the field—such as high denylist bypass rates, unaddressed TOCTOU races, and fragmented treatment of MCP threats—and references four previously disclosed, already-patched CVEs. Severity is low-to-medium as a direct threat signal since no new vulnerability or attack technique is disclosed; its value is as a roadmap of known/likely weak points defenders should prioritize.
Technical Analysis
The paper aggregates findings on sandbox isolation, capability/access control, policy enforcement, and TOCTOU races in AI coding agents that execute shell commands and call tools with limited oversight. It identifies that policy-enforcement denylists fail 69-98% of the time under adversarial testing, that TOCTOU races and MCP-specific threats are really the same class of state-validation vulnerability (an attacker changes the state of a resource between check and use, e.g., a tool description or file that passed a security check being swapped before execution), and that current defenses assume an honest policy author, leaving policy-authoring mistakes as an open attack surface. It also notes benign-but-out-of-scope agent actions occur at rates up to 17.1%, indicating agents frequently exceed intended capability boundaries even without malicious intent. No new exploit code, CVE, or working payload is introduced; the entry point and 'attacker gain' described are aggregate research conclusions about where real attackers could focus (sandbox escape, TOCTOU races against tool/file state, MCP tool-description tampering, and denylist bypass).
Affected Systems
AI coding agent harnesses (unspecified, referenced generically as production agent harnesses in surveyed CVEs); protocols: MCP
Detection Signatures
- N/A - survey paper, no specific IOCs
- Monitor for: repeated tool/file state changes between validation and execution (TOCTOU pattern)
- Monitor for: agent actions outside declared capability scope (out-of-scope action rate benchmarking)
- Monitor for: denylist/policy bypass attempts in shell command execution logs
- Review: MCP tool description content for mismatches against actual invoked behavior
Remediation Steps
- 1
Adopt shared benchmarking across isolation architectures
Evaluate sandbox and capability-model defenses against a common adversarial benchmark rather than in isolation, per the paper's recommendation.
- 2
Re-test policy enforcement under adversarial denylist bypass
Assume denylists will be bypassed at high rates (69-98% per cited research) and layer allowlist-based, capability-scoped enforcement instead of relying on denylists alone.
- 3
Unify TOCTOU and MCP state-validation defenses
Treat MCP tool/resource validation and TOCTOU races as the same class of problem; implement atomic check-and-use patterns, cryptographic pinning of tool descriptions, and re-validation immediately before execution.
- 4
Address policy-authoring error
Add tooling to detect and test for mistakes in the security policies/allowlists themselves, not just enforcement mechanism failures.
- 5
Constrain and audit benign out-of-scope actions
Instrument agents to detect and block actions outside declared task scope even when non-malicious, given observed rates up to 17.1% under realistic prompting.
- 6
Track and patch known CVEs in agent harnesses
Review the four disclosed CVEs referenced in this survey and confirm patches are applied in any production coding-agent deployment.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.