One symlink unlocked every credential

brig is an agent sandbox: it runs an AI agent against a project directory the operator names. Per Endor Labs' write-up, brig guarded its own workspace with four checks, but it passed the operator-named project path through to the virtual machine monitor exactly as it had been typed, unresolved. The agent has read-write access to that project. So the agent can replace a subdirectory inside its own project with a symlink to somewhere else, and the next time a run is narrowed to that subdirectory, the monitor follows the link on the host and mounts whatever it points at, read-write.

The four checks were aimed at brig's own files. The project path was treated as the operator's, and therefore as safe. That is a confused deputy: the guard trusted a value that the sandboxed party could later change.

Endor Labs confirmed the traversal on macOS under a microVM and on Linux with nerdctl and containerd. Once the link resolved on the host, a run could reach the operator's ~/.ssh, ~/.aws, and gh hosts.yml, and the guest home of every other session. Writing to authorized_keys would be code execution as the host user. It was classified CWE-59, improper link resolution before file access, with a CVSS 3.1 score of 8.2, and the researchers were explicit that this was not a hypervisor or guest-kernel escape. It was a boundary gap between the operator's path and the mount.

A human configured that path, and that is what made it trusted; an agent with write access used precisely that trust to change it underneath the guard.

The advisory is GHSA-wp6x-29qx-fpr7, also tracked as ENDOR-VUL-2026-1809, and the fix landed in brig 0.3.0. Endor Labs credited coordinated disclosure with the vendor. Peyton Kennedy wrote the analysis, published 28 September 2026.

The lesson reaches past brig: a path that a privileged component trusts because a human typed it is still a path the sandboxed agent may be able to change before the component resolves it.