Credentials exfiltration persists across Mac sandboxes

The author tested a simulated hostile AI agent across five different Mac sandboxes, including Seatbelt, Docker Sandboxes, gVisor, and Firecracker. The testing revealed that while various sandboxes stopped specific behaviors, a credentials exfiltration vector remained open across all five environments. The author argues that on a laptop, controlling what an agent is allowed to access matters more than the specific sandbox chosen. Open article →