Agent Builder Foundations

The DeepSeek harness gave the sandboxed shell the control interface's address and the session ID, so its own tooling could use them. The interface accepted any request whose Host header matched an expected value. A code comment said that check "is not an auth layer", and nothing else stood in for one. The agent could therefore call the interface and set its session to danger-full-access. The fix in 0.1.2-rc.1 requires a one-time startup token exchanged for a signed cookie, a secret the sandbox never sees.

Ask two questions of every control surface in your harness:

• Can the confined process reach it? If the sandboxed shell can reach the host and port, or write the file, it is a working path whether or not you meant the agent to use it.
• Can it authenticate as a legitimate caller? A Host header, path, or claimed session ID is something the caller sets. Authentication needs a secret the caller only has if it was issued one.

Either answer being "no" closes the hole. CVE-2026-82533 failed both. Meta's Muse client failed both through a config file: any local process could write the preference, and the client trusted whatever was on disk.

Network control plane. The harness ran the sandboxed agent and a local control interface on the same host. The interface served the harness's browser UI and included a danger-full-access mode for users who want to run unsandboxed. To let tooling reach it, the harness exported the interface address and session ID into the sandboxed shell's environment.

A Host-header check blocks some cross-origin browser attacks, but it says nothing about who is calling, because every client sets its own Host header. The agent could send the expected value, call the interface, and flip its mode. From then on its commands ran with no containment.

The token-and-cookie fix changes what reachability buys. A process that was never handed the startup token cannot mint a valid cookie, so being on the same host is no longer enough.

Config control plane. Muse read endo_voyager_dictation_endpoint, the server that receives dictation audio, from storage any unprivileged user could write. It trusted the value with no signature or default check. Overwriting it redirected microphone audio and the account auth token to an attacker. Because Muse held broad macOS permissions, prompt injection over the hijacked channel could also pull local files. Meta's fix removed the setting from production builds instead of authenticating writes to it.

• Keep the control plane off the sandbox's network path. The confined shell should not be able to resolve or reach the interface that manages its own privilege.
• Authenticate with an out-of-band secret, such as a token exchanged once at trusted startup and then carried in a signed cookie. Never with a header, path, or identifier the caller supplies.
• Treat every escalation mode ("full access", "sandbox off", "skip approval") like a production admin endpoint, not an internal convenience.
• Audit what you inject into the sandbox: environment variables, mounted sockets, and config that describe infrastructure the process should not act on.
• Verify a patch requires a secret the sandboxed process never had, not a stricter version of the same request-attribute check.
• Strip debug and diagnostic config keys from production builds if an unprivileged process can write them and they redirect endpoints or widen permissions.

• Treating a Host-header or path check as authentication.
• Handing the sandbox addresses or identifiers for the infrastructure that confines it, assuming the agent "wouldn't" use them.
• Building an escalation mode for the harness's own tooling without asking whether the confined process can reach it too.
• Assuming "local-only" means safe, when local includes the sandboxed process on the same host.
• Shipping a writable debug config key that steers a privileged client, assuming the file is as protected as the app that reads it.

See agent sandboxing for the baseline containment toolkit and tool use for how harness-internal interfaces become agent-reachable surface. Compare cyber-eval sandbox escapes, where the boundary was never closed rather than opened from inside.