Sandbox Provisioning Bug Threatens AI Agent Isolation
NVIDIA disclosed CVE-2026-65083, a critical vulnerability in OpenShell for Linux — NVIDIA's open-source runtime for running autonomous AI agents inside kernel-level sandboxed environments. The flaw sits in the sandbox's provisioning API, the component responsible for generating and applying the list of operations a sandboxed process is not allowed to perform.
An attacker who can influence that provisioning step can cause the API to build an incomplete disallowed-input list, undermining the sandbox's core security guarantee before the sandboxed process even starts.
Vulnerability Details
| Detail | Value |
|---|---|
| CVE | CVE-2026-65083 |
| CVSS Score | 9.9 (Critical) — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Type | Improper restriction of security-relevant inputs |
| Attack Vector | Network, low complexity, low privileges required |
| Affected Product | NVIDIA OpenShell for Linux |
| Impact | Code execution, privilege escalation, information disclosure, data tampering, denial of service |
| Disclosed | August 25, 2026 |
How the Vulnerability Works
OpenShell's sandbox provisioning API is what defines the security boundary for each sandboxed AI agent process — it compiles the set of operations, paths, and calls that should be explicitly blocked before the agent's code ever runs. CVE-2026-65083 allows a low-privileged attacker to craft input to this API that causes it to generate an incomplete version of that block-list.
Because the sandbox's enforcement is only as strong as the list it was provisioned with, an incomplete list means operations that were supposed to be denied — including potentially dangerous system calls or filesystem access — go unblocked. That gap can be leveraged toward code execution and privilege escalation outside the intended sandbox boundary.
Part of a Broader OpenShell Security Review
CVE-2026-65083 was disclosed alongside a cluster of related OpenShell CVEs on the same day, suggesting NVIDIA or its researchers conducted a focused security review of the sandbox architecture:
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-65083 | Incomplete disallowed-input list in provisioning API | Critical (9.9) |
| CVE-2026-65093 | Direct sandbox escape | Critical (9.9) |
| CVE-2026-65091 | OS command injection via malicious gateway | High (8.8) |
| CVE-2026-65092 | Path traversal bypass of L7 REST network policy | High (8.5) |
See our companion advisory on CVE-2026-65093 for the related direct sandbox-escape flaw.
Who's at Risk
OpenShell is positioned for running long-running autonomous AI agents with kernel-level isolation — the kind of workload increasingly deployed in agentic AI pipelines with access to internal tools, credentials, and infrastructure. A weakened sandbox boundary in that context is high-stakes: an agent that escapes its intended isolation could reach the host system, other agents, or connected infrastructure.
| Use Case | Risk |
|---|---|
| Multi-tenant agent hosting | Critical — one agent could compromise the host or neighboring tenants |
| Internal AI tooling with system access | Critical — sandbox was the only isolation layer |
| Experimental / research agent deployments | High — often run with broader permissions during development |
Remediation
- Check NVIDIA's official security channels for a patched OpenShell release — no patch details were available at initial disclosure.
- Until patched, treat OpenShell sandbox isolation as unreliable. Add a secondary isolation layer (VM-level or container-level) rather than relying on OpenShell's sandbox as the sole boundary.
- Restrict which inputs reach the provisioning API — limit who can configure or trigger sandbox provisioning to trusted operators only.
- Monitor sandboxed agent processes for system calls or file access outside their expected profile, which may indicate the block-list gap is being exploited.
Key Takeaways
- A CVSS 9.9 flaw in the provisioning step undermines the sandbox before the agent even runs — this isn't a runtime bypass, it's a foundational configuration weakness.
- AI agent sandboxes are becoming a primary security boundary in agentic deployments — flaws here have outsized impact.
- This is one of four related OpenShell CVEs disclosed the same day — treat any OpenShell deployment as needing a full patch review, not just this single CVE.
- Defense in depth matters — don't rely on a single sandbox layer for workloads with meaningful blast radius if compromised.