Docker's YOLO Mode and the Case for Permission-Level AI Agent Security

Docker this week launched a feature called YOLO mode within its Sandboxes product, giving AI coding agents like Claude Code and GitHub Copilot CLI isolated microVMs with outbound firewalls so they can run unattended without human oversight. Unlike standard containers, each session uses a dedicated microVM with its own kernel running on a hypervisor, providing stronger isolation for agents that install packages and execute arbitrary commands. A senior software engineer at BS23 in Dhaka, building production AI agents with Spring Boot and Spring AI, argues that a microVM cage suits coding agents but not conversational e-commerce assistants with defined tool sets. During adversarial testing, the engineer discovered that a product description embedded with fake user instructions caused the agent to follow those instructions instead of answering the customer's question — an indirect prompt injection attack originating from the agent's own catalog. This highlighted three distinct attack channels for tool-equipped agents: direct user injection, indirect injection via tool outputs, and privilege abuse through tool side effects, each requiring its own targeted defense rather than process-level sandboxing.