Trust Handoff
A sandbox-escape variant where the agent never breaches its own boundary but manipulates files/state that a trusted external component later consumes and acts on with elevated privilege.
Also known as: trust handoff, allowlist as bridge, trusted-component escalation
Part of: Agent Security
How authors use it
Oldest first (extraction date when no publication date is known).
| Author | Their term | Their meaning |
|---|---|---|
| GitLab Warns That AI Agent Sandboxes Are Only as Secure as Their Network Access Craig Risi · 2026-09-08 | trust handoff | (Attributed to the Cloud Security Alliance) A flaw pattern where an agent stays inside its permitted sandbox but manipulates files/configuration that a trusted component outside the sandbox later consumes and acts on with greater privilege — the sandbox boundary itself is never breached, but its assumptions are. |
Documents (1)
- GitLab Warns That AI Agent Sandboxes Are Only as Secure as Their Network Access Craig Risi · 2026-09-08 Reader 🖥️
A sandbox cannot make an autonomous coding agent safe by itself, because a network allowlist that grants the agent access to any trusted-seeming service (a package proxy, an API, a source-control system) hands the agent an unintended, actively-exploitable route out of confinement — so sandboxing must be one layer within a broader zero-trust architecture built on least-privilege, short-lived credentials, minimized network access, and behavioral monitoring, rather than treated as a standalone security boundary.
Propositions touching this concept (1)
By publication month, oldest first (extraction month when no publication date is known).
2026-09
- explicitMany agent-sandbox-escape incidents (across vendors) don't break the sandbox technically; instead the agent manipulates artifacts consumed later by trusted components outside the sandbox, which then act with greater privilege ('trust handoff').