2 CVSS 9.8 Agent Sandbox CVEs Landed the Same Day

If you pip install an AI agent sandbox and start it the way the README says, who can reach it? Two CVE records published on September 5 answer with a CVSS 3.1 score of 9.8. Both times. CVE-2026-86121 sits in the computer-server component of Cua, one of the better known open-source computer-use agent projects. CVE-2026-86124 sits in the sandbox TCP server of AutoAgent. Both were disclosed the same morning by the same researcher, two seconds apart in the CVE feed, and both reduce to one sentence: the sandbox listens on every network interface and accepts commands from anyone who connects. I maintain a small MCP security scanner and write about agent security here weekly, and I still had to read both records twice. Here is what shipped, the fix Cua already merged, the patch situation in AutoAgent that is still open, and the five checks I now run before starting any local agent sandbox. Both bugs start with a default that looks harmless in a code review. Here is the Cua shape, the AutoAgent variant follows: # The shape of the Cua bug, CVE-2026-86121 # (reconstructed from the CVE record and fix commit 59cf25c0ec54, # not verbatim source) bind_host = "0.0.0.0" # listen on every interface auth_enforced = container_name_is_set() # auth off in "local mode" Why does one unset variable switch off authentication? CONTAINER_NAME is how Cua detects that the server runs inside its managed container. When the variable is unset, the server assumes local mode and skips authentication entirely. At the same time, the CLI default for --host was 0.0.0.0, so local mode still listened on every interface, including the one your coffee shop Wi-Fi gave you. The CVE record spells out the exposed surface: TCP port 8000 with a run_command endpoint that executes shell commands, file endpoints for arbitrary read and write, and an interactive PTY. No credentials at any step. The two defaults contradict each other. The auth skip assumes only the person at the machine can reach the port. The bind default assumes the network is friendly. Neither checks the other, and together they are a 9.8. What the fix changed Version 0.3.42 flips the default: local mode binds 127.0.0.1, and the fix commit documents the change plainly. Per the pull request discussion on the repo, going public now requires an explicit opt-in through CUA_ALLOW_INSECURE=1, and a cross-site origin check for the sensitive endpoints (/cmd, /ws, /pty) was still working through review when I read the thread. Fail-closed default with a documented escape hatch is the pattern worth copying into your own tools. How does AutoAgent turn a sandbox into a root shell? AutoAgent's variant is more blunt. Per the VulnCheck advisory, its TCP server binds 0.0.0.0 with no authentication and passes attacker-supplied bash to a shell, while its Docker environment runs the container as root and publishes the port on all interfaces: # The shape of the AutoAgent sandbox defaults, per the advisory # (port number illustrative; the advisory does not pin one) services: sandbox: user: root ports: - "8080:8080" # publishes on 0.0.0.0 volumes: - ./workspace:/workspace # host directory, writable Connect to the published port, send a bash command, and you are root inside the container. The bind mount means the container's filesystem contains your host workspace, so root in the container reads and writes real files on your machine. The affected range runs through commit 16c12b052. As of the September 5 records, the advisory points to issue #96 but lists no confirmed fixed release, so I treat mitigation as the operator's job for now and would re-check the issue before running anything. Is a container still a sandbox when it runs as root with a bind mount? This is the part I keep turning over. Both projects wrapped dangerous capabilities in Docker, and both CVE records describe the container as the layer that was supposed to contain the damage. Docker's own documentation is more careful than that: rootless mode exists precisely because root-in-container is not a hard security boundary, and a bind mount is the feature that opens a path back to the host. A root container with a writable host mount is not a sandbox. It is your machine, with extra steps. I wrote last month that your AI agent is the most over-privileged account you own. These CVEs are that argument with a severity score attached: root container, network listener, workspace mount, granted in the first minute, no ticket. What the CVSS numbers do not tell you Both records carry 9.8 on CVSS 3.1 and 9.3 on the newer 4.0 scale, map to CWE-306, and neither was on CISA's KEV catalog when I read them. I found no confirmed in-the-wild exploitation in the advisories I checked, and EPSS had not scored either one yet. I am stating that uncertainty on purpose. These sandboxes run on laptops and home servers, exposure is a function of your LAN and your port forwards, and absent telemetry is not absent risk. The nuance worth knowing if you write detection content: the 4.0 vector confirms network attack vector and no privileges required, but the real exposure question is which interface the service bound, and no CVSS vector captures that. What would I check before running either project today? Five checks, in the order I now run them: Pin the version. Cua's computer-server at 0.3.42 or later. For AutoAgent, confirm a fixed release exists on issue #96 before you pull anything. Bind to loopback. If a tool exposes a host flag, 127.0.0.1 unless you can say out loud why something else needs to connect. Never run the container as root. Map a non-root user even for local experiments. Publish ports on loopback only, and skip publishing entirely when the agent and the client share a machine. Mount read-only unless the task truly writes, and keep credentials out of every mounted directory. The hardened shape of the same compose file: services: sandbox: user: "1000:1000" ports: - "127.0.0.1:8080:8080" # loopback only volumes: - ./workspace:/workspace:ro environment: # Cua: upgrade to 0.3.42+ for the loopback default. # Pre-0.3.42 skipped auth whenever CONTAINER_NAME was unset. Who is actually to blame here? My position, and I expect pushback on it: secure defaults are the vendor's job, and local mode is not a permission model. The auth skip assumed nobody untrusted could reach the port. The bind default made that assumption false. Two individually defensible defaults composed into a 9.8, which is why I think default composition deserves its own review pass, separate from any single line of code. The sharper argument is the container one. I am close to believing that any agent framework which defaults to root containers plus writable bind mounts should document that choice as prominently as it documents features, because the container is exactly what users will lean on as the security boundary. Maintainers will reasonably answer that local dev tools trade safety for convenience on purpose, and that a threat model for people who port-forward their laptop is not a threat model for everyone. Where is the line? I do not have a clean answer, and the comments are the right place to argue it. If you want more of this thread, I wrote about the MCP attack your code review cannot see and about my own scanner missing the year's worst MCP RCE. Same lesson from different angles: check what your tools assume before you trust what they ship. Primary sources: CVE-2026-86121, CVE-2026-86124, VulnCheck on Cua, VulnCheck on AutoAgent, Cua issue #1892, AutoAgent issue #96.