I am evaluating secure sandbox surfaces for high-trust agent environments (benchmarking, SFT, expert on-policy supervision, outcome based RL, etc). Obviously there are some pre-baked solutions, one that is attractive is Docker's sbx (docker.com/products/docker-s…). Sbx runs agents inside isolated Linux microVM's with their own kernel and private Docker Engine. They use filesystem passthroughs and host-side bridges to facilitate file access, networking, mcp tool usage, credentials, etc. These microVM's offer a very strong execution boundary but obviously the brokers are a major attack surface. Looking through the changelog for sbx, the situation is a bit more grim than you would expect. Between June 1 and today (Oct 24) there are 9 CVE's including critical issues (like a macOS virtio-fs escape CVE-2026-77179). These look like typical logic issues you might expect. What's interesting though is that the changelogs also reveal areas that got security fixes but no CVE. For example, a full broker mediated guest-to-host escape, shown in the poc below (on v0.39.0 before Sept 7). Some light reverse engineering was required since you don't get core implementation source. Pre-patch a sandbox could supply DBUS_SESSION_BUS_ADDRESS through the guest-controlled host_env sent to the host browser bridge. On the Linux host, the bridge passed that environment to xdg-open, whose desktop-detection path invoked dbus-send, which accepts a "unixexec:" address leading to code execution.