Coding Agent Horror Stories: The Command You Already Approved
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A detailed breakdown of CVE-2026-22708, a Cursor vulnerability disclosed by Pillar Security where shell built-ins like export, typeset, and declare could silently modify environment variables (PAGER, PYTHONWARNINGS, PERL5OPT) without triggering Auto-Run allowlist prompts. A later approved command such as git branch would then execute attacker-controlled code because the environment variable it relied on had been poisoned moments earlier. The bug worked even with an empty allowlist and ultimately let an attacker exfiltrate SSH private keys in Pillar's proof of concept. Cursor rated the issue High and patched it in version 2.3, five months after Pillar's August 2025 report. The piece then explains how Docker Sandboxes contain the blast radius by running agents in isolated microVMs: SSH keys never live inside the box, the ~/.zshrc persistence trick fails, and egress is deny-by-default, though the live workspace and shared skills store remain caveats unless --clone and opt-out flags are used. Docker's kits and AI Governance features are presented as ways to codify and centrally enforce these network/credential boundaries with audit logging.
Table of contents
Today’s Horror Story: The Approval That Ran Something ElseThe ProblemThe Scale of the ProblemTechnical Breakdown: How the Attack WorksThe ImpactHow Docker Sandboxes Contain This at the Execution LayerCodify the Boundary with KitsWhat This Looks Like in PracticeMaking This Hold Across a TeamBest PracticesTake ActionConclusionQuestions this post answers
What is CVE-2026-22708 in Cursor and how does it bypass the Auto-Run allowlist?
CVE-2026-22708 is a Cursor vulnerability where shell built-ins like export, typeset, and declare can silently change environment variables such as PAGER or PYTHONWARNINGS without appearing in the Auto-Run allowlist or triggering an approval prompt, because the allowlist only checks for programs on disk, not built-ins. A later allowlisted command like git branch then reads the poisoned variable and executes attacker code instead, even with a completely empty allowlist. Cursor rated it High severity and patched it in version 2.3. Teams hardening AI coding agent workflows can track vulnerabilities like this one on daily.dev.
How do Docker Sandboxes protect against SSH key theft from a compromised AI coding agent?
Docker Sandboxes run agents in isolated microVMs where the home directory, including ~/.ssh/id_rsa, sits on the host and is never copied into the box, so a payload searching for the key file finds nothing. However, an SSH agent socket is still forwarded in for git operations, meaning code inside the sandbox can authenticate using the key without ever exfiltrating it, so network egress policy is the remaining control that limits abuse. Engineers weighing sandbox isolation trade-offs for agent credentials can follow this research on daily.dev.
Why did Pillar Security recommend deprecating command allowlists for AI coding agents?
Pillar Security argued allowlists should be deprecated because they only check the name of a command, not what it actually does at runtime, so an environment variable poisoned moments earlier can hijack a fully approved command like git branch into running arbitrary code. Instead, Pillar recommended giving agents full command execution inside an isolated environment such as a microVM, since isolating what an agent can reach is a more dependable control than judging every instruction it reads. Developers choosing between allowlists and sandboxing for agent safety can compare approaches on daily.dev.