Executive brief
nono is a tool used to run AI agents in a secure, isolated environment (sandbox) to prevent them from making unauthorized changes to the host system. A flaw in the sandbox's security policy allows these AI agents to bypass their restrictions and interact with the host's system services. An exploit could allow an agent to write files or run commands with the same permissions as the user who launched it, potentially leading to data loss or unauthorized system activity.
Technical details
A sandbox escape vulnerability exists in nono's Landlock and seccomp security policies. The policies incorrectly allow access to local Unix domain sockets (both concrete and abstract), which enables a sandboxed process to communicate with the per-user systemd D-Bus socket. By interacting with this socket, an attacker or a malicious AI agent can use 'systemd-run --user' to spawn unsandboxed processes. This allows the attacker to execute arbitrary commands and modify files with the full privileges of the user running the sandbox. The issue is addressed in version 0.55.0 by restricting Unix domain socket access.
Affected products
- nolabs-ai nono < 0.55.0
Timeline
- 2026-05-17: advisory: GitHub advisory published by maintainers
- 2026-07-20: disclosed: CVE published to NVD