What changed
The UK AI Security Institute shipped two breaking and security fixes to Inspect, its open evaluation toolkit, on 14 and 15 October 2026.
Inspect 0.3.280 blocks writable host directory mounts in Docker sandboxes by default. The problem statement is specific. An agent that can write a host directory can rewrite Compose files or redirect mount sources with symlinks, so a later sample gets host access nobody intended. The toolkit now rejects those mounts before the sandbox starts, for every service and for resolved sample settings. Read only host mounts and ordinary Docker managed volumes are still allowed. A documented unsafe opt in remains for teams that accept the risk. Read only host mounts, and Compose configs and secrets, now require Docker Engine 25 or newer, Compose 2.24 or newer, and Linux kernel 5.12 or newer on the Docker host, because older combinations can leave some subdirectories writable.
Inspect 0.3.281 changes readfile() in the Docker sandbox. The old path used docker compose cp, which unpacked an archive the sandboxed agent controls onto the host before Inspect checked it. On Compose older than 5.4.0, the project cites a crafted archive that can write outside the extraction directory (CVE-2026-17106, advisory GHSA-hfg8-hc9c-6c3h). The Inspect issue says that escape was not demonstrated through readfile() itself. The sandbox model still treats agent shaped archive contents as untrusted. Separately, the whole file landed on the host disk before the size limit was applied, so a read could fill the disk. The new path streams the archive to standard output and reads it in memory, stopping at the size limit. Nothing from the container is written to the host, on any Compose version.
The same 0.3.281 release requires Python 3.11 and is tested on Python 3.14. Sentinel monitors can call context.host.score. Those are behavior changes beside the sandbox fix, not the security claim.
Why it matters
Eval sandboxes are where untrusted model actions run. A writable mount turns the host that grades the model into something the model can edit. An archive copy that lands on the host before a size check does the same with disk space, and on old Compose it is the shape of a sandbox escape even though Inspect's own issue does not claim a finished exploit through read_file().
The counterpoint is operational. Labs that pass a host directory into the sandbox so the agent can write outputs will find those runs rejected. The migration path in the change is read only mounts, Sample.files, Docker managed volumes, or the unsafe opt in. Read only mounts are not free. They now depend on a newer engine, Compose plugin, and kernel. Teams pinned to older Docker hosts cannot take the safe option without an upgrade.
Who is affected
Groups running Inspect evals in Docker, including red team and safety evals that mount a working directory from the host. Platform owners who provide the Docker host, because the kernel and engine versions are now part of the safety property. It does not, by itself, change a production agent that never uses Inspect.
What to do next
Upgrade eval hosts to 0.3.281, then run one existing Docker eval that mounts a host path. If it fails, switch that path to read only or to Sample.files before anyone reaches for the unsafe opt in. Confirm the Docker host is on Engine 25 or newer, Compose 2.24 or newer, and kernel 5.12 or newer if you still share host files. Do not treat the cited Compose advisory as proof that your old read_file() path was already exploited. Treat it as the reason the copy no longer touches host disk.
What to watch
Whether a later Inspect release removes the unsafe opt in, and whether the Compose advisory is revised to say the issue was or was not reachable through Inspect's old read_file() path. The two change requests are the record until then.
Image: UK AI Security Institute
Image: UK AI Security Institute
Sources
- Primary — UK AI Security Institute, Inspect changelog 0.3.280 and 0.3.281 (14 and 15 October 2026). The version dates, the mount behavior change, the
read_file()fix, the Python 3.11 requirement, and sentinel scoring. - Primary — UK AI Security Institute, block writable host mounts in Docker sandboxes by default (14 October 2026). The symlink and Compose file risk, the allowed alternatives, and the engine, Compose, and kernel floor.
- Primary — UK AI Security Institute, Docker read_file no longer unpacks agent controlled archives on the host (15 October 2026). The archive copy, the size limit gap, and the statement that the escape was not demonstrated through
read_file(). CVE-2026-17106 is the Compose archive issue named in that request.