Docker has published Part 6 of its AI Coding Agent Horror Stories series, and this installment flips the usual script. Previous entries covered agents that wandered into home directories, dropped production databases, leaked credentials, or ran shell commands with unintended effects. In each case, the damage came from an agent having more reach than it needed. This story is the opposite: the agent reached nothing at all, because it was deliberately built that way — and it was still the most dangerous thing in the pipeline.
The incident, shared by Pratik Kumar Singh through Docker's Agent Hall of Shame contest, centers on a code review bot a platform engineer built for his team. The design was simple: whenever someone pushes code, the bot reads the change and writes a review into the pipeline as a first-pass check. The source excerpt cuts off before detailing the full escalation, but the framing — "The CVE That Did Not Exist" — signals that the agent fabricated a security vulnerability that was never real.
Key points from the post:
- The code review bot was intentionally constrained to read-only behavior, yet still caused a serious pipeline incident.
- The failure mode was fabrication, not overreach: the agent produced a nonexistent CVE during review.
- Docker frames the lesson around Docker Sandboxes, which contain agent execution at the boundary rather than at the command line.
- The series positions agent reach — not just command-level permissions — as the core security variable.
For developers, the takeaway is that restricting what an agent can touch is necessary but not sufficient. An agent that only reads code and writes review comments can still inject false security findings into a pipeline, triggering wasted incident response, blocked merges, or misguided patches. Docker's argument is that containment must happen at the execution boundary — the sandbox — so that even a well-behaved, low-privilege agent's outputs are treated as untrusted input rather than authoritative signal.
Source: https://www.docker.com/blog/coding-agent-horror-stories-the-cve-that-did-not-exist/