[chaksaray]

Closes #330.

Adds AVE-2026-00088, Sandbox side-effect trust handoff: a sandboxed coding agent, steered by content it reads, writes a file the sandbox allows (a hook definition, an editor task, Git metadata or hooks, the agent tool's own project configuration, a virtualenv interpreter), and a more-privileged component outside the sandbox later executes it as trusted configuration, so the agent's side effect runs on the host. MEDIUM, AIVSS 6.4.

One commit, following the 00087 precedent (4f3173b): the record, both fixtures, CHANGELOG, README and the dist pair.

Sources read (all opened directly)

Source	Date	Credit as stated	What it establishes
Cursor GHSA-pc9j-3qc2-95wv (CVE-2026-48124)	2026-05-21	none listed	"A malicious workspace or agent-created file could configure hooks that run local commands in the user's context when an agent turn ends. This could allow sandbox escape". Affected 2.4.37, patched 3.0.0, CVSS 4.0 8.5.
Anthropic GHSA-ff64-7w26-62rf (CVE-2026-25725)	2026-02-06	"hackerone.com/edbr"	Sandboxed code could create the unprotected .claude/settings.json and "inject persistent hooks ... that would execute with host privileges when Claude Code was restarted". CWE-501, CWE-668.
Cursor GHSA-8pcm-8jpx-hv8r (CVE-2026-26268)	2026-02-13	"Novee Security Research Team", "Daniel Teixeira – Nvidia AI Red Team", "Philip Tsukerman"	"A malicious agent (ie prompt injection) could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox RCE". Fixed in 2.5. Earliest vendor-confirmed instance.
Cursor GHSA-p9g2-cr55-cw9c (CVE-2026-73217)	2026-07-14	reporter Danus365	The agent replaces a virtualenv's Python executable; the Python extension runs it outside the sandbox. Fixed in 3.1.2.
Pillar: The hook was already in the workspace	2026-07-20	Eilon Cohen	PoC for CVE-2026-48124: "Cursor could be made to trust automation settings written inside the workspace by the agent itself."
Pillar: Git directories do not have to be called .git	2026-07-20	Eilon Cohen	--separate-git-dir past a literal .git/config deny rule, then core.fsmonitor run by Cursor's Git extension host. Patched in 3.0.0, "awaiting CVE".
Pillar: A time bomb in .vscode	2026-07-20	Dan Lisichkin	Antigravity agent writes a runOn: folderOpen task; VS Code runs it on the host. Google: "Other valid security vulnerabilities", downgraded.
Pillar: The Week of Sandbox Escapes	2026-07-20	Eilon Cohen, Dan Lisichkin & Ariel Fogel	Names the cross-vendor pattern.
Cymulate: Configuration-Based Sandbox Escape	disclosed 2026-04-07 (page updated 2026-05-03)	Ilan Kalendarov, Ben Zamir, Elad Beber	Same class, named independently: Claude Code (CVE-2026-25725), Gemini CLI (writable settings.json mount, unresolved), Codex CLI (apply_patch creates .codex/config.toml, whose notify runs outside the sandbox; OpenAI closed it as "Informational").

Excluded from the class as different mechanisms: the Docker-socket escape (CVE-2026-73218), the Antigravity allow-default seatbelt, GitPwned (allowlisted git show --output, which never ran sandboxed), Cymulate's Gemini where.exe pre-launch planting, and the Codex agents.md vector.

Distinctness

Compared field by field (fingerprint, provenance_vector, security_boundary where present) with 00064, 00054, 00050, 00084, 00071, 00075 and 00063, plus the token-overlap top five (00004, 00054, 00064, 00052, 00076). The crux is 00064. That record covers attacker-supplied project configuration that auto-runs on project load, a pre-consent boundary. Here the writer is the sandboxed agent, the file usually does not exist in the repository at all, and the trigger is usually not project load, so 00064's fix does not close it. The overlap is real for one vector of CVE-2026-48124, whose advisory names both "a malicious workspace" and "an agent-created file". The full comparison is in #330 and in aivss.notes.

Q6, stated plainly

Replace the LLM with a deterministic program that has the same workspace write access and the flaw partly survives: any sandboxed process whose output a privileged consumer trusts can escape the same way. What remains agentic:

• The sandbox exists to contain a model steered by untrusted content, and the attacker needs only text the model reads, not code execution inside the sandbox.
• The write decision comes from model reasoning over injected content.
• In most instances the trusted consumer is the agent harness itself, treating its own agent's writes as the user's configuration.

Classified A, not E, with that caveat written into the record. Discussion #234 has no recorded decision; its proposed test ("no model reasoning in the trigger") would not exclude this class.

Scoring

cvss_base 7.7 from CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, the CVE-2026-25725 advisory's own vector and the most conservative vendor reading (Cursor scored its instance 8.5; CVE-2026-26268 was 8.0 under CVSS 3.1).

AARF factor	Value	Rationale
autonomy	1	Once written, the trusted component executes the file on its own trigger, with no further attacker step and no prompt.
tool_use	1	The artifact is produced by the agent's own file-write or shell tool.
non_determinism	0.5	Exploitation depends on the model following injected content.
self_modification	0.5	In the hook, notify and settings instances the agent rewrites its own harness's configuration; not in the Git, task or venv instances.
dynamic_identity	0.5	The consumer extends user-authored trust to an agent-written file (authorship trust-anchor confusion), scored as 00084 scored inherited vetting trust.
persistent_memory	1	The file stays on disk and re-fires on every later trigger ("persistent hooks" in the CVE-2026-25725 advisory).
data_access	1	Execution runs as the user on the host.
external_dependencies	1	Severity depends entirely on which host-side consumer trusts which file.
multi_agent, natural_language_input	0	Single agent. The boundary step is structural (a config file executed), which the scoring reference scores 0.

aars 6.5, thm 0.90, mitigation_factor 1: ((7.7 + 6.5) / 2) x 0.9 x 1 = 6.39, so 6.4 MEDIUM, confirmed by validate_records.py.

Framework mappings (each read from its primary source today)

• owasp_mcp MCP05: its checklist at commit 165fe0f names "Execution occurs across different contexts ... without re-validation". MCP02 was read and rejected.
• owasp_asi ASI05: the 2026 document names "sandbox escape", and its Example 4 is an agent-generated object executed by another component without validation. ASI02 routes code-execution outcomes to ASI05. ASI03 was read and rejected.
• mitre_atlas AML.T0105 (Escape to Host) and AML.T0081 (Modify AI Agent Configuration), from the live ATLAS.yaml v5.6.0. T0105's own text describes this route.
• nist_ai_rmf []: checked, no fit. MEASURE 2.7 is generic.

Verified

• validate_records.py passes (88 valid), pytest 523 passed, and check_fixtures.py, check_framework_sources.py --strict --only, check_vulnerability_taxonomy.py --strict --only, the confidence ratchet (1 record changed, passes) and check_terms_sync.py all pass.
• dist/ave-records-latest.json equals records/ for all 88 records. The frozen v1.1.0 snapshot is untouched.
• All 13 URLs in the record return 200. The em-dash count in the diff is 0.
• verification_basis was stamped by write_verification_basis.py --write (artifact_reconstructed).

Could not verify

• Novee's own write-up. Secondary coverage dates it 2026-04-28, but I could not locate the first-party post, so it is not cited.
• Pillar's own post on the venv finding is marked "Write-up coming soon". That instance rests on Cursor's advisory alone.
• Whether Danus365 and hackerone.com/edbr correspond to named people in the Pillar and Cymulate teams. Neither advisory says, so the record does not assert it.

Judgment calls for the maintainer

1. Severity and thm. CONTRIBUTING's scale gives 0.90 for "PoC exists" and 1.0 for in the wild. references/aivss-scoring.md says demonstrated mechanisms score 1 and that "every record in this corpus so far has scored 1", which is stale: 25 records are at 0.75 and 13 at 0.9. At thm 1 this record would be 7.1 HIGH.
2. entry_class model_generated, reused from 00056 because the payload is something the agent produces rather than reads. runtime is the alternative.
3. Credit goes to three parties. Your runbook named Pillar, plus Cymulate if its post described the same mechanism, which it does. I added the CVE-2026-26268 credits because that is the earliest vendor-confirmed instance.
4. AML.T0081 fits only the subset where the written file is the agent harness's own configuration. Drop it if you prefer T0105 alone.
5. README severity table. On develop it said HIGH 19 and MEDIUM 65, but the records said HIGH 20 and MEDIUM 64: fix: AVE-2026-00044, new variant instance from Clinejection #294 moved AVE-2026-00044 from MEDIUM 6.1 to HIGH 8.1 without updating the README. This PR sets the table to the live counts (HIGH 20, MEDIUM 65), so the diff shows HIGH +1 and MEDIUM unchanged. 00044's own README row still says 6.1 MEDIUM; I left it for a separate fix, since this PR's README changes are limited to the four kinds the 00087 precedent made.
6. Unstamped records. write_verification_basis.py --write also stamped 8 existing canonical records that have no verification_basis on develop (00001, 00010, 00020, 00023, 00038, 00043, 00047, 00081). I reverted those, since this PR must not modify existing records. Anyone running --write will pick them up.

🤖 Generated with Claude Code