AI Agent Isolation Broken by Sandbox Escape
NVIDIA disclosed CVE-2026-65093, a critical sandbox escape vulnerability in OpenShell for Linux, the company's open-source runtime for executing autonomous AI agents in kernel-isolated sandboxes. A successful exploit lets an attacker break out of the sandbox entirely — reaching well beyond the boundaries OpenShell is designed to enforce.
Unlike a partial policy bypass, this is described as a direct escape from the sandboxed environment, meaning code that should be confined to the agent's isolated context can instead execute with broader access to the underlying system.
Vulnerability Details
| Detail | Value |
|---|---|
| CVE | CVE-2026-65093 |
| CVSS Score | 9.9 (Critical) — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Type | Sandbox escape / improper isolation |
| Attack Vector | Network, low complexity, low privileges required |
| Affected Product | NVIDIA OpenShell for Linux |
| Impact | Code execution, privilege escalation, data tampering, information disclosure |
| Disclosed | August 25, 2026 |
| Patch Status | Not yet published at time of disclosure |
How the Vulnerability Works
NVIDIA's advisory confirms the outcome — a full sandbox escape — without naming the exact vulnerable function or bypass technique. The practical effect is that an attacker with low privileges inside an OpenShell-sandboxed agent can break the isolation mechanisms meant to confine that agent's operations, gaining the ability to execute arbitrary code or commands outside the intended security boundary.
Sandbox escapes of this kind typically trace back to misconfigurations, logic flaws in policy enforcement, or vulnerabilities in the underlying components the sandbox depends on (kernel namespaces, seccomp filters, or similar isolation primitives). With no CVSS attack-complexity penalty (AC:L) and no user interaction required, this is squarely in the range attackers can automate against.
Part of a Broader OpenShell Security Review
CVE-2026-65093 was disclosed the same day as three related OpenShell flaws, pointing to a concentrated security review of the sandbox architecture:
| CVE | Issue | Severity |
|---|---|---|
| CVE-2026-65093 | Direct sandbox escape | Critical (9.9) |
| CVE-2026-65083 | Incomplete disallowed-input list in provisioning API | Critical (9.9) |
| CVE-2026-65091 | OS command injection via malicious gateway | High (8.8) |
| CVE-2026-65092 | Path traversal bypass of L7 REST network policy | High (8.5) |
See our companion advisory on CVE-2026-65083 for the related provisioning-API flaw — the two may compound each other in a real attack chain.
Who's at Risk
Any deployment relying on OpenShell's sandbox as the primary or sole isolation boundary for AI agents is exposed. That risk scales with what the agent — and by extension the host it escapes to — has access to: credentials, internal APIs, other tenants' data, or production infrastructure.
| Use Case | Risk |
|---|---|
| Multi-tenant agent hosting | Critical — escape reaches the host and potentially neighboring tenants |
| Agents with credentialed access to internal systems | Critical — escape inherits whatever the host process can reach |
| Isolated, single-purpose agent sandboxes with no sensitive host access | Reduced, but still exploitable for local disruption |
Remediation
- No patch was available at initial disclosure. Monitor NVIDIA's official OpenShell channels and apply the fix as soon as it ships.
- Do not treat OpenShell's sandbox as a sufficient isolation boundary on its own until patched — layer it with VM-level or container-level isolation for any agent with meaningful system access.
- Reduce blast radius in the meantime: strip sandboxed agents of credentials and network access they don't strictly need, so an escape has less to reach.
- Watch for anomalous host-level activity originating from processes tied to OpenShell-managed agents — unexpected file access, network connections, or privilege changes.
Key Takeaways
- A CVSS 9.9 direct sandbox escape defeats OpenShell's core security promise — isolation of untrusted or semi-trusted AI agent code.
- No user interaction and low attack complexity mean this is exploitable at scale wherever OpenShell sandboxes are reachable.
- Four related CVEs disclosed the same day signal a systemic review of the sandbox — patch for all of them, not just this one.
- Agentic AI infrastructure is a new high-value target — sandbox escapes here have the same severity implications as hypervisor escapes did for virtualization.