Skip to content

The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities

🕒 Published (v1): 2026-07-07 01:56 UTC · Source: Arxiv · link

Why this paper was selected

Systematic survey of execution-security isolation for coding agents — TOCTOU vulns in harness layer

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This is a systematization-of-knowledge (SoK) survey that organizes 39 execution-security papers (2023–2026) into 17 categories covering sandboxing, access control, TOCTOU races, MCP threats, and related topics for AI coding agents. It identifies five cross-cutting gaps invisible from within any single category and confirms four real CVEs in production agent tooling. The paper argues execution security for agents is a distinct systems-security problem with no dedicated prior survey.

Problem

Execution-security research for AI coding agents is siloed: sandbox papers do not cite denylist fragility papers, TOCTOU and MCP threat papers describe the same structural race without shared vocabulary, and three existing broad agentic-security surveys treat isolation as one item among many. No existing work systematizes the execution-security literature on its own terms or reads across categories to surface gaps spanning multiple mechanisms.

Method

Pure SoK methodology: (1) iterative keyword search (sandbox, execution isolation, agent harness, capability, TOCTOU, MCP, etc.) on arXiv and web literature; (2) strict verification protocol — every candidate paper fetched at its arXiv abstract page and checked for exact title, full author list, and venue before inclusion (two candidates corrected or dropped); (3) each of 39 verified papers assigned to exactly one of 17 categories by primary execution-security mechanism; (4) all counts mechanically re-derived from a released machine-readable CSV corpus so the taxonomy is auditable and falsifiable; (5) cross-category reading to identify gaps no single paper addresses. Four CVEs also verified directly against the NIST NVD rather than via secondary description.

Key Contributions

  • Verified corpus of 39 papers (2023–2026) organized into 17 execution-security categories (isolation architectures, escape benchmarks, access control, policy enforcement fragility, TOCTOU, MCP threats, systems framing, harness-level evaluation, identity delegation, provenance, network egress, static analysis, scope-creep measurement, plugin packaging security, and foundations).
  • Direct NVD-verified confirmation of four production CVEs: CVE-2024-21626 (runc container escape), CVE-2025-53773 (GitHub Copilot command injection), CVE-2025-59536 (Claude Code trust-dialog TOCTOU, CVSS 8.8), CVE-2026-21852 (Claude Code API-key exfiltration before trust confirmation, CVSS 7.5).
  • Five cross-cutting gaps identified: (1) isolation vs. access-control architectures never benchmarked against each other; (2) policy enforcement papers report 69–98.6% denylist fragility yet isolation papers do not re-evaluate their defenses under those adversarial conditions; (3) TOCTOU and MCP threats share the same validate-then-act structure but are analyzed as separate literatures; (4) every enforcement mechanism assumes an honest policy author; (5) benign but out-of-scope agent actions occurring at rates up to 17.1% are unaddressed by any access-control paper.
  • Released machine-readable corpus file (title, authors, venue, year, category) enabling independent re-derivation of every count.
  • Research agenda directed at closing the five gaps rather than restating surveyed papers' own future work.

Results

No new experiments are run; the paper is a SoK. Empirical findings drawn from the surveyed corpus: - 69.0%–98.6% of 1,709 real GitHub command denylists are fragile to automated bypass (ShellSieve). - 7.2% of 1,899 open-source MCP servers carry traditional vulnerabilities; 5.5% exhibit MCP-specific tool poisoning; 66% show code smells. - TOCTOU rate in agent trajectories reduced from 12% to 8% using prompt rewriting + state-integrity monitoring + tool-fusing (Mind the Gap, 66-task benchmark). - Open Agent Passport enforcement drops attacker success from 74.6% to 0% under a strict policy (assumes enforcement framework itself is uncompromised). - Transactional sandbox design reports 100% interception of high-risk commands and 100% rollback success (self-evaluated). - DeltaBox cuts sandbox checkpoint/rollback latency to single-digit milliseconds via delta snapshotting. - Harness-level CTF evaluation (33 tasks, 5 scaffolds): no single harness dominates; a shared-blackboard ensemble outperforms every individual scaffold. - Pwn2Own Berlin 2026 Coding Agents category: $1,298,250 paid out across 47 zero-days; all three targets (Claude Code, Codex, Cursor) had real vulnerabilities demonstrated.

Limitations

  • No new attacks or defenses are built; findings are bounded by what the 39 surveyed papers actually measure.
  • Corpus completeness depends on search-term coverage; grey literature, proprietary systems, and non-English venues are likely underrepresented.
  • Single-category assignment forces each paper into one bucket, potentially obscuring papers that genuinely span mechanisms.
  • The five gaps are identified qualitatively by cross-reading; no formal coverage metric is defined.
  • The harness-level capability evaluation category contains only one paper, so its conclusions about scaffold design are drawn from a single empirical data point.
  • Policy-authoring error and the scope-creep failure mode are identified as unaddressed gaps but no solutions are proposed.

Relevance to Harnesses / Meta-Harnesses

The paper directly treats the agent harness as an execution-security variable, dedicating an explicit category (Category 8) to harness-level capability evaluation and noting that "which tools a scaffold exposes and how it sequences them shapes the attack surface as much as any sandbox or policy layered on top." The two confirmed Claude Code CVEs (CVE-2025-59536, CVE-2026-21852) both involve the harness's project-load and trust-dialog flows — precisely the meta-harness boundary between untrusted repository content and privileged agent actions. For researchers building or auditing harnesses, this SoK provides a structured vocabulary (isolation, capability, TOCTOU, MCP surface, provenance) and a gap map indicating that harness design choices are currently evaluated in isolation from the policy-fragility and scope-creep findings that should stress-test them.