2026-07-06 · Article
The Sandbox Is Not a Strategy
Why "we scoped its permissions" stopped being an answer in 2026.
Security researcher Johann Rehberger reported a flaw in GitHub Copilot's "YOLO mode" to Microsoft on 29 June 2025. Microsoft patched it in the August 2025 Patch Tuesday release and it was catalogued as CVE-2025-53773, rated 7.8, high severity. The mechanism was almost insultingly simple: an attacker hid an instruction inside a code comment, a source file, or even a GitHub issue. When Copilot's agent read that content, it could be manipulated into silently adding one line to a project's settings file, chat.tools.autoApprove: true, which switched the assistant into unattended "YOLO mode" and let it execute shell commands with no further user confirmation. Remote code execution, achieved entirely through a sentence a human would have skimmed past without a second thought.
That is the incident this article is built around, because it is the cleanest possible illustration of a mistake a lot of growing companies are making right now. They looked at article one's problem, an agent with unrestricted production access, correctly diagnosed it as dangerous, and fixed it by putting the agent in a sandbox with scoped permissions. Then they filed the problem as solved. It is not solved. It has moved.
What "sandboxed" actually stopped
A scoped, sandboxed coding agent genuinely does stop the article-one failure mode: the agent that has full production credentials because nobody thought to take them away. Reduce the blast radius of the environment, and a bad decision by the agent stays contained inside that environment. This is real progress and mid-market companies that have done it are ahead of where they were.
What sandboxing does not stop is an agent being told to do the wrong thing in the first place, by content it was never supposed to trust. The Copilot YOLO mode CVE did not need the agent to have excessive permissions. It needed the agent to read a comment and treat it as a command. The sandbox was irrelevant, because the compromise happened at the instruction layer, not the execution layer.
The supply chain made this worse, not better
Weeks after a separate, first-of-its-kind vulnerability, CVE-2026-25253, was disclosed in the OpenClaw agent runtime in January 2026, demonstrating remote code execution through a crafted skill package, attackers ran with the opening. The campaign researchers named ClawHavoc published more than 1,200 malicious skills to the OpenClaw marketplace, each one designed to look like a legitimate extension, deploying the AMOS credential stealer onto enterprise developer machines that installed them.
Every one of those 1,200 skills passed through a marketplace that a mid-market engineering team reasonably assumed had some baseline vetting, the same assumption a developer makes about an npm package or a VS Code extension. A sandboxed agent that pulls in a compromised skill does not need to break out of its sandbox. The sandbox faithfully executes exactly what the malicious skill tells it to, because from the sandbox's point of view, that is legitimate, permitted code.
The numbers say this is now routine, not exceptional
Across the industry, 88% of organisations confirmed or suspected an AI agent security incident in the past year, and only 21.9% treat their AI agents as independent, identity-bearing entities with their own access controls and audit trail, rather than as an extension of whichever developer's session launched them. Separately, research from Galileo AI found that in multi-agent systems, a single compromised agent can poison 87% of downstream decision-making within four hours, because agents that hand work to other agents inherit trust along with the task.
Speed compounds the exposure. In April 2026, security researchers demonstrated an AI agent autonomously compromising a hardened operating system in under four hours. A McKinsey red-team exercise separately showed an agent achieving full enterprise access in 120 minutes. None of these results depended on the agent having broad permissions from the start. They depended on the agent being fed something it trusted that it should not have.
What mid-market companies need instead of a bigger sandbox
The fix is not a tighter sandbox. It is treating everything the agent reads, code comments, pulled dependencies, marketplace skills, retrieved documents, as untrusted input by default, the same discipline applied to user input on a public web form. Concretely, that means: scanning and pinning every skill or extension an agent can install, the same way a mature engineering team pins dependency versions rather than trusting latest. Logging every file the agent reads and every command it runs with a timestamp and an identity, not just what it changed, because you cannot investigate an incident you never recorded. Treating the agent as its own identity in the access control system, not a silent extension of whoever's laptop launched it, which is the exact gap 78% of agents currently sit inside.
None of this requires enterprise-scale governance infrastructure. It requires accepting that "we sandboxed it" answers a different question from the one the 2026 incident data is actually asking.
Where this series goes next
Article three moves to the stage where the stakes stop being a compromised laptop and start being a regulated enterprise with a nation-state-capable adversary and a regulator watching, and looks at what JPMorgan, Uber, and the EU AI Act actually require once an organisation reaches that scale. Article four synthesises all three stages into the Blast Radius Ladder, a single framework for placing your organisation honestly on the maturity curve this series describes.
Tech Sight's own governance framework, TechSight TAG, uses this same ladder as its opening diagnostic. Its delivery methodology, TechSight 90, is the 90-day path from wherever you are on it to a governed deployment.
Sources: CVE-2025-53773, GitHub Copilot "YOLO mode" remote code execution vulnerability, reported to Microsoft by researcher Johann Rehberger on 29 June 2025 and patched in the August 2025 Patch Tuesday release, CVSS v3.1 base score 7.8 (NVD; CVE.org; Wiz Vulnerability Database; Embrace The Red); CVE-2026-25253, first CVE assigned to an agentic AI system, OpenClaw runtime, disclosed January 2026, and the subsequent ClawHavoc campaign (AI Automation Global, "AI Agent Security Vulnerabilities 2026"; Lushbinary, "AI Agent Security 2026"); AI agent security incident and identity-governance statistics, Gravitee State of AI Agent Security 2026 survey of 900+ practitioners; multi-agent cascading-failure research, Galileo AI 2026; autonomous compromise speed benchmarks, April 2026 security research and McKinsey red-team results (as reported in Foresiet's 2026 AI-enabled cyberattack analysis).
Book the two-hour diagnostic