Linux agent sandboxing broken when `allowNetwork` mode is set

Open
#320,504 7 comments 0 reactions 1 assignee View on GitHub

@dileepyavan is already working on this.

Since Jun 8, 2026.

Assessment

This issue has not been assessed yet.

Description

agent-sandbox info-needed

While verifying https://github.com/microsoft/vscode/issues/314041 I discovered filesystem isolation does not appear to be enforced when chat.agent.sandbox.enabled is set to allowNetwork.

Does this issue occur when all extensions are disabled?: Yes

  • VS Code Version: Latest Insiders
  • OS Version: Bluefin / Fedora Silverblue

Steps to Reproduce:

  1. Potentially install required OS dependencies (such as bubblewrap) to ensure sandboxing works. Copilot can help verify/fix this.
  2. Create a test workspace: mkdir ~/vscode-sandbox-workspace
  3. Create a file outside of the workspace: echo "You should not be able to see this!" > ~/vscode-sandbox-outside-read-test.txt
  4. Add the following settings (JSON):
{
  "chat.agent.sandbox.enabled": "allowNetwork",
  "chat.agent.sandbox.allowUnsandboxedCommands": false,
  "chat.agent.sandbox.fileSystem.linux": {
    "denyRead": ["~"],
    "allowRead": ["~/vscode-sandbox-workspace"],
    "allowWrite": ["~/vscode-sandbox-workspace"],
    "denyWrite": []
  }
}
  1. Start a new chat thread and send the following prompts one after the next:
Prompt #1:
curl -sS -L -o /dev/null -w 'status=%{http_code} final_url=%{url_effective}\n' https://microsoft.com

Expected result:
status=200 final_url=https://www.microsoft.com/

Prompt #2:
echo "Reads and writes inside workspace work!" > ./sandbox-write-test.txt && cat ./sandbox-write-test.txt

Expected result:
Reads and writes inside workspace work!

Prompt #3:
cat ~/vscode-sandbox-outside-read-test.txt 2>&1; echo exit=$?

Expected result:
You should not be able to see this!
exit=0

Conclusion:

  • ✅ Good: The allowNetwork behavior should work. Outbound network access should succeed without configuring allowed domains.
  • ✅ Good: Workspace reads and writes should work since we explicitly allowed them in settings JSON.
  • ❌ Bad: Filesystem isolation is not enforced.
    • The ~/vscode-sandbox-outside-read-test.txt file is still readable despite denyRead: ["~"], explicit workspace allow rules, and chat.agent.sandbox.allowUnsandboxedCommands: false.
Dominant language
TypeScript
Stars
193k
Forks
42.9k
PR metrics pending

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/vscode

All issues in microsoft/vscode

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.