A new post from Docker’s security team highlights a critical risk in AI-assisted development: coding agents (like Copilot, Cursor, or Codex) often operate with a set of pre-approved commands (e.g., apt install, curl, npm install) to function efficiently. Attackers can exploit this by injecting malicious code into a repository or dependency that triggers one of these approved commands during a routine agent run—effectively executing attacker-controlled code under the user’s privileges, with no additional prompt.
The blog outlines the attack vectors: a poisoned package in a lockfile, a malicious commit in a PR, or even a crafted README.md that instructs the agent to run a destructive command. The danger is that developers often auto-approve common operations to save time, and agents may not validate the integrity of every input.
Key points from the article:
- Pre-approved command abuse: Attackers craft inputs that cause an agent to invoke a command it has already been permitted to run—bypassing the approval step entirely.
- Wide-open blast radius: Without isolation, a malicious command can read the developer’s SSH keys, access cloud credentials, or modify the host system—leading to supply-chain compromise.
- Docker Sandboxes as a safety net: Running coding agents inside a Docker Sandbox restricts the environment—limiting filesystem access, network egress, and system calls. Even if a malicious command runs, the attacker only reaches the container, not the host.
- Recommendations: Use read-only bind mounts, revoke default network access, and enforce least-privilege policies for agent commands.
The implications are clear: as AI agents increasingly automate development tasks, they become a prime target for prompt-injection attacks. Docker’s sandboxing provides a practical, low-friction way to contain the damage—turning a potential system-wide breach into a contained incident that can be disposed of with a container restart.
Source: https://www.docker.com/blog/coding-agent-horror-stories-the-command-you-already-approved/