Skip to content

The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

🕒 Published (v1): 2026-07-07 01:56 UTC · Source: Arxiv · link

Why this paper was selected

First taxonomy of isolation, access control, TOCTOU vulnerabilities across AI coding agent execution layers

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This is a systematization-of-knowledge (SoK) paper that organizes 39 execution-security papers for AI coding agents (2023–2026) into 17 categories, verifies each directly against its source, and identifies five cross-cutting gaps invisible from within any single category. It argues execution security—sandboxes, access control, TOCTOU races, MCP threats—is structurally distinct from model-level alignment and currently lacks a dedicated systematization.

Problem

The execution-security literature for AI coding agents is fragmented: sandbox isolation, capability models, TOCTOU races, MCP threats, and policy-enforcement fragility papers are published independently and rarely cross-cite. Three existing broad agentic-AI security surveys treat execution isolation as one item in a wide catalog rather than a subject with internal structure. No prior work organizes execution-security mechanisms on their own terms or identifies the gaps that emerge only when reading across categories.

Method

Pure SoK methodology: no new attacks or defenses are built. The authors searched arXiv and web literature using terms such as sandbox, execution isolation, agent harness, capability, access control, TOCTOU, and Model Context Protocol, iterating as new author groups and vocabulary surfaced. Inclusion required a paper to (a) address the execution layer of an LLM-based agent and (b) be published between January 2023 and writing time. Every candidate paper was verified by fetching its arXiv abstract page directly and recording the exact title, full author list, and venue. Two candidates failed this check and were corrected or dropped. The 39 verified papers were assigned to exactly one of 17 categories by primary mechanism. All counts are mechanically re-derived from a released machine-readable CSV; an independent checker verifies that no entry is duplicated and every citation resolves. Four CVEs affecting production agent harnesses were confirmed directly against the NIST National Vulnerability Database.

Key Contributions

  • Systematized corpus of 39 execution-security papers (2023–2026) organized into 17 categories: isolation architectures, escape/adversarial benchmarks, access control and capability models, policy-enforcement fragility, TOCTOU, MCP-specific threats and defenses, systems-security framing, harness-level capability evaluation, identity/credential delegation, execution provenance/auditability, network egress control, static analysis of agent-generated code, scope-creep measurement, and skill/plugin packaging security.
  • Direct NIST NVD confirmation of four patched CVEs in production agent tooling: CVE-2024-21626 (runc container escape), CVE-2025-53773 (command injection in GitHub Copilot/VS 2022, CVSS 7.8), CVE-2025-59536 (code injection in Claude Code <1.0.111, CVSS 8.8), and CVE-2026-21852 (data exfiltration in Claude Code project-load flow, CVSS 7.5).
  • Five cross-cutting gaps identified: (1) isolation architectures and capability models never evaluated against one another on a shared benchmark; (2) policy-enforcement studies show 69–98.6% denylist fragility yet no isolation paper re-evaluates under that adversarial setting; (3) TOCTOU and MCP threats are analyzed as separate literatures despite being the same state-validation problem; (4) every enforcement mechanism assumes an honest policy author, leaving policy-authoring error unaddressed; (5) benign out-of-scope agent actions occurring at rates up to 17.1% are addressed by no access-control paper in the corpus.
  • Released machine-readable corpus file (key, verified title/authors, venue, year, category) enabling auditable, falsifiable classification.
  • Research agenda organized around closing the five gaps rather than restating surveyed papers' own future-work sections.

Results

  • 69.0%–98.6% of real command denylists scraped from GitHub are fragile to LLM-generated bypasses (ShellSieve, tested against 1,709 denylists).
  • TOCTOU flaw rate in executed agent trajectories reduced from 12% to 8% using prompt rewriting + state-integrity monitoring + tool-fusing (TOCTOU-Bench, 66 tasks).
  • 7.2% of 1,899 open-source MCP servers carry traditional vulnerabilities; 5.5% exhibit MCP-specific tool-poisoning; 66% show code smells.
  • Open Agent Passport drops attacker success rate from 74.6% to 0% under strict policy enforcement (assumes enforcement framework is not compromised).
  • Transactional sandbox reports 100% interception rate for high-risk commands and 100% rollback success in its own evaluation.
  • DeltaBox reduces checkpoint/rollback latency to single-digit milliseconds via delta-state snapshotting.
  • IsolateGPT imposes under 30% overhead on most tested queries.
  • Benign but out-of-scope agent actions occur at rates up to 17.1% under realistic prompting (scope-creep measurement paper).
  • Pwn2Own Berlin 2026 Coding Agents category: $1,298,250 paid across 47 unique zero-days; OpenAI Codex fell to CWE-150 for $40,000; Cursor exploited in two entries.

Limitations

  • SoK methodology: no empirical measurements, no new defenses; all quantitative claims are inherited from surveyed papers with varying rigor.
  • 39-paper corpus is necessarily incomplete; coverage depends on search-query vocabulary, which may miss sub-communities using different terminology.
  • Single-category assignment per paper may obscure papers with contributions spanning multiple mechanisms.
  • The five gaps are identified by expert reading across categories, not by a formal gap-analysis protocol; the characterization is the authors' judgment rather than a mechanically derived result.
  • The corpus covers only 2023–2026; the field is moving fast enough that a paper written at the time of submission may already be outdated in the category counts.
  • Corpus verification confirms bibliographic identity but does not re-run experiments or independently validate numerical claims within each paper.

Relevance to Agentic AI / LLM Agents

This SoK directly maps the threat landscape for any system where an LLM agent executes shell commands, calls tools via MCP, or manages files with limited human oversight—exactly the operational model of frontier coding agents. The five cross-cutting gaps it identifies (especially the isolation-vs-capability evaluation gap and the unaddressed scope-creep failure mode at 17.1%) are actionable research targets for anyone building or evaluating agent harnesses. The confirmed CVEs in Claude Code itself make the execution-security boundary concrete and non-speculative. For researchers tracking agentic AI, this paper is the missing reference that connects sandbox, TOCTOU, MCP, and capability-policy literatures into a single structured view.