Executive brief
PentAGI, an AI-powered penetration testing system, contains a vulnerability that allows its AI agents to escape their isolated sandbox environments. By using specially crafted prompts, an attacker can trick the AI into accessing the underlying host system's Docker interface. This could allow an attacker to take full control of the server hosting the application, potentially leading to data theft or further attacks on the internal network.
Technical details
A container escape vulnerability exists in vxcontrol PentAGI up to 2.1.0 due to the insecure mounting of the host Docker socket (/var/run/docker.sock) into agent sandbox containers when deployed via Docker Compose. By utilizing prompt injection against the AI agents, a remote attacker with low privileges can interact with the Docker API via backend/pkg/docker/client.go. This allows the attacker to escape the containerized environment and execute arbitrary commands on the host system, such as launching new privileged containers with host filesystem access. While hardening measures like 'no-new-privileges' and capability dropping have been proposed in pull request #355, the primary mitigation involves setting DOCKER_INSIDE=false or using a least-privilege socket proxy.
Affected products
- vxcontrol PentAGI up to 2.1.0
Timeline
- 2026-06-05: disclosed: Issue #337 reported on GitHub
- 2026-06-24: other: Hardening pull request #355 submitted
- 2026-07-06: advisory: CVE-2026-14784 published