Controls › C-E5
Containment and isolation
Sandbox, network egress, and communication limits on a test or untrusted actor.
Envelope layerMissing or failed in 5 cases (2 ended in harm)Worked in 0Software agents: 4Machines: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| OpenAI agent, Medicare portal 2026 | Software agents | Containment of the test environment | failed | Ended in harm |
| GitHub MCP leak 2025 | Software agents | No limit on where the agent could send what it read: it was connected with permission for the private repositories as well as the public one, and it wrote private-repository data into a public pull request. No approval prompt is recorded stopping it: Claude Desktop, used in the researchers' run, confirms individual tool calls by default, though the researchers say many users choose Always Allow, and they do not say which setting their run used; the author of the reproduction posted in issue #844 writes that there is human-in-the-loop verification, a 'Continue' button with a 'See More' preview of what the click will do | absent | Caught first by researchers |
| OpenAI agents, Hugging Face 2026 | Software agents | Sandbox isolation; Internal communication controls; Internet egress controls | failed | Ended in harm |
| Triton 2017 | Machines | Safety-network segmentation | failed | Stopped by the operator's control |
| EchoLeak 2025 | Software agents | Output protections bypassed in turn: redaction of external links and images, by reference-style markdown the redaction did not recognize, and the content-security rules, by routing the fetch through a Microsoft Teams domain they allowed (trusted-domain exception) | failed | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| NERC Critical Infrastructure Protection standards (CIP-005, CIP-007, CIP-013, CIP-015), approved by FERC (draft mapping) | Required by the text | CIP-005: electronic security perimeter and controlled remote access to control systems | United States (bulk electric system) |
| TSA Security Directive Pipeline-2021-02 series: cybersecurity of pipeline and LNG control systems (draft mapping) | Required by the text | network segmentation so operational technology keeps running safely if information technology is compromised | United States (designated pipeline and LNG operators) |
| UN Regulation No. 155: cyber security and cyber security management system (draft mapping) | Implied | isolation between external interfaces and vehicle control | Contracting parties to the 1958 Agreement (not the United States) |
| Connected vehicles rule: vehicle connectivity systems and automated driving systems with a China or Russia nexus (15 CFR part 791, subpart D) (draft mapping) | Implied | the rule's stated purpose: removing a path by which a foreign party could reach vehicle systems remotely through the connectivity system | United States |
| IEC 61511: functional safety of safety instrumented systems for the process industry (draft mapping) | Recommended | independence from the basic process control system is a containment requirement | International standard |
| NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (2022) (draft mapping) | Recommended | isolation and segmentation of safety-critical vehicle systems from external connectivity | United States (voluntary) |
| Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (NIST CAISSI, NSA SISC and CISA, PP-26-4396, version 1.0) (draft mapping) | Recommended | Practice 7, Verify and Strengthen Containment Before Resuming SI Agent Activity: 'Rebuild any environments that may have been compromised from verified baselines.' | United States (voluntary) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-30 | CVE-2026-62863: MoLing, a computer-use and browser-use Model Context Protocol (MCP) server, accepts unauthenticated tool calls that a malicious web page can send in Server-Sent Events (SSE) mode The National Vulnerability Database (NVD) record says that before 0.5.0, MoLing's SSE-mode endpoints do not authenticate requests, so a malicious web page a user visits can obtain a session identifier and send unauthorized MCP tool calls that, depending on the configured tools, can read or write local files or execute commands; fixed in 0.5.0. Source ↗ | vulnerability |
| 2026-10-29 | CVE-2026-119050: Agno PandasTools lets prompt injection make the agent call arbitrary pandas functions, including reading pickle files for code execution The National Vulnerability Database (NVD) record says Agno through 3.1.11 has an unsafe reflection vulnerability in PandasTools that passes model-controlled function names to getattr(), so attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files. Source ↗ | vulnerability |
| 2026-10-29 | CVE-2026-110193: IBM Langflow OSS Agentic Assistant can be made to generate or submit code that runs operating system commands The National Vulnerability Database (NVD) record says IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code that results in arbitrary operating system command execution on the server. Source ↗ | vulnerability |
| 2026-10-23 | CVE-2026-106765: @rog0x/mcp-docker-tools, a Model Context Protocol (MCP) server, executes arbitrary code via its handleImageList function The GitHub-reviewed advisory GHSA-fq6x-j3g6-xx83 says an issue in @rog0x/mcp-docker-tools 1.0.1, a Model Context Protocol (MCP) server package, allows a remote attacker to execute arbitrary code via the handleImageList function. Source ↗ | vulnerability |
| 2026-10-23 | CVE-2026-106763: @justice8096/sagemath-mcp-server, a Model Context Protocol (MCP) server, executes arbitrary code via its escapeShellString and sanitizeCode functions The GitHub-reviewed advisory GHSA-2vq3-mpmf-9xgr says an issue in @justice8096/sagemath-mcp-server 1.0.1, a Model Context Protocol (MCP) server package, allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. Source ↗ | vulnerability |
| 2026-10-23 | CVE-2026-106764: @rog0x/mcp-git-tools, a Model Context Protocol (MCP) server, executes arbitrary code via its resolveBaseBranch function The GitHub-reviewed advisory GHSA-jwc4-922r-f2rw says an issue in @rog0x/mcp-git-tools 1.0.1, a Model Context Protocol (MCP) server package, allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. Source ↗ | vulnerability |
| 2026-10-21 | CVE-2026-114106: HKUDS Vibe-Trading file-read tools The National Vulnerability Database (NVD) record says HKUDS Vibe-Trading from 0.1.0 before 0.1.7 lets attackers prompt the agent to read server files, including /etc/shadow, API keys in /proc/self/environ and /root credentials, through read_document, which lacks sandbox checks, or tools gated by safe_user_path. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-77932: DB-GPT The National Vulnerability Database (NVD) record says DB-GPT through 0.8.2 lets unauthenticated callers reach the /api/v1/chat/react-agent endpoint, whose user check grants every caller the admin role, and send prompts that make the ReAct agent's unsandboxed code and shell tools run arbitrary Python or bash as root in the webserver container. Source ↗ | vulnerability |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.