# GHSA-wp6x-29qx-fpr7: brig Agent Sandbox: Project-Mount Symlink Traversal Let a Coding Agent Get Any Host Directory Mounted Read-Write (GHSA-wp6x-29qx-fpr7, CVSS 8.2)

> GHSA-wp6x-29qx-fpr7 is a high-severity credential theft issue (CVSS 8.2) in brig, an AI agent. Affected: brig (github.com/brig-sh/brig) < 0.3.0; fixed in 0.3.0 (26 September 2026).. Fixed in 0.3.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/ghsa-wp6x-29qx-fpr7
- **Aliases:** ti-125
- **Severity:** high
- **CVSS:** 8.2
- **Attack type:** Credential theft, Path traversal, Sandbox escape
- **Component:** brig (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-26
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/ghsa-wp6x-29qx-fpr7

## Summary

brig is a Go tool for running AI coding agents such as Claude Code inside a container or microVM sandbox. It mounted the project the operator named read-write without resolving the path first, refusing only a path that resolved to /. Because the agent can write to the project, it can replace a subdirectory with a symlink to any host directory, and on the next run that names that subdirectory the runtime follows the link on the host and exports the target read-write into the sandbox, exposing ~/.ssh, ~/.aws, ~/.config/gh/hosts.yml, brig's own state and other sessions' guest homes; write access to authorized_keys or a shell startup file then gives code execution as the user. The hypervisor and guest-kernel boundaries are not broken (brig acts as a confused deputy), and --network isolated or offline does not stop it. The maintainers published GHSA-wp6x-29qx-fpr7 (CVSS 3.1 8.2) and released the fix in 0.3.0 on 26 September 2026; the bug arrived on 1 September with the named-project feature. Endor Labs researcher Peyton Kennedy published the write-up on 28 September, reproduced on macOS 15 and Ubuntu 24.04 including reading a host SSH key. No CVE had been assigned at publication.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| brig (github.com/brig-sh/brig) < 0.3.0; fixed in 0.3.0 (26 September 2026). | 0.3.0 |

## Am I affected by GHSA-wp6x-29qx-fpr7?

You are affected if you run brig (github.com/brig-sh/brig) < 0.3.0; fixed in 0.3.0 (26 September 2026).. Versions 0.3.0 and later include the fix.

## How do I fix GHSA-wp6x-29qx-fpr7?

Upgrade brig to 0.3.0 or later, which resolves the project path one component at a time, refuses symlinks below the first writable directory and prints the resolved directory. Until then, pass a resolved path, e.g. `brig run claude "$(cd <dir> && pwd -P)"`, and treat any project path that runs through a directory a sandbox previously had read-write as suspect. Rotate SSH keys, cloud credentials and gh tokens on hosts where agents ran under brig < 0.3.0, and keep credentials an agent does not need off those hosts. Network isolation modes do not mitigate this issue.

## How do I find every machine running brig?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run brig and which version, then enforce a policy on it.

## References

- article: https://www.endorlabs.com/learn/project-mount-symlink-traversal-in-brig-how-a-sandbox-reaches-host-directories-it-was-never-given
- advisory: https://github.com/advisories/GHSA-wp6x-29qx-fpr7

## Related vulnerabilities

- [CVE-2026-46331](https://catalog.anomity.ai/vuln/cve-2026-46331) — high
- [ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf](https://catalog.anomity.ai/vuln/ghostapproval-symlink-bypass-hits-claude-code-cursor-windsurf) — high
- [opencode-console-breach-saved-openai-anthropic-and-google-provider-keys](https://catalog.anomity.ai/vuln/opencode-console-breach-saved-openai-anthropic-and-google-provider-keys) — high
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high
- [manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction](https://catalog.anomity.ai/vuln/manus-one-email-with-a-jsfuck-payload-or-one-shared-project-instruction) — high
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=ghsa-wp6x-29qx-fpr7