2026-09-28 · 2026-Q3
brig: An Agent Swaps a Directory for a Symlink and Gets Host Directories Mounted Read-Write Into Its Sandbox
Primary layerL6 Identity / Run
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Unknown
Target
brig, a runner that confines AI coding agents in sandboxes
Impact
Endor Labs disclosed on September 28, 2026 that brig versions before 0.3.0 did not resolve project paths before handing them to the container runtime. An agent working in a project could replace a subdirectory with a symlink to any host directory; when the operator later ran an agent on that subdirectory, brig mounted the link target read-write inside the sandbox. Fixed in 0.3.0 (GHSA-wp6x-29qx-fpr7, CVSS 8.2, ENDOR-VUL-2026-1809)
Root cause
The sandbox trusted a path the sandboxed agent could rewrite, so the confined workload chose the next sandbox's mounts
Sources
Catalog
Cite this: AgentProv incident record: brig: An Agent Swaps a Directory for a Symlink and Gets Host Directories Mounted Read-Write Into Its Sandbox (2026-09-28). https://agentprov.com/incidents/2026-09-28-brig-an-agent-swaps-a-directory-for-a-symlink-and-gets-host-directories-mounted
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run