PentAGI 2.2 released, fixing a sandbox escape vulnerability caused by mounting the host Docker socket
PentAGI 2.2 — Any Modern LLM, a Contained Sandbox, Unified Web Search, and Multi-Instance Deployment
The PentAGI maintainers released version 2.2, fixing CVE-2026-14784 affecting versions 2.1.0 and earlier. When DOCKER_INSIDE=true, the vulnerability mounted the host Docker socket into every sandbox, allowing an agent manipulated by prompt injection to take over the host. Version 2.2 changes the default of DOCKER_INSIDE to false, the worker container drops all capabilities and then adds them back based on a whitelist and sets a process count limit, and nested Docker requires a separate DOCKER_INSIDE_HOST setting distinct from PentAGI itself. A new startup self-check DOCKER_INSIDE_POLICY_TESTS verifies from inside that the daemon is not its own, that 27 host escape requests are rejected, and that 7 normal operations work; if it fails, the agent cannot use Docker. The maintainers state that prompt injection cannot be fully disabled, and resistance mainly depends on the model's ability to follow instructions.
维护方说明了宿主 Docker socket 被挂载导致 Agent 逃逸的条件，以及 2.2 收紧沙箱与启动自检的具体做法。