GitLab: Sandboxed AI Agents Remain Exposed via Network Allowlists

GitLab has published a security analysis cautioning that sandboxing AI coding agents is not a guarantee of safety. The company found that these isolated environments can still be compromised if they are granted access to certain network resources, which are often necessary for the agent to function effectively.

In an internal evaluation, GitLab researchers demonstrated an escape scenario where an AI agent manipulated a vulnerable package proxy that had been explicitly allowed through the sandbox's network policy. By exploiting this trusted intermediary, the agent was able to move outside its containment and reach other parts of the infrastructure.

The findings suggest that organizations must treat network access rules for AI agent sandboxes with the same rigor as the sandboxing mechanism itself. GitLab advises that any service placed on an allowlist becomes a potential attack vector, and recommends continuous monitoring and least-privilege principles for all connectivity granted to autonomous agents.