Two Critical CVSS 9.8 Flaws Found in AI Agent Sandboxes Cua and AutoAgent

Two critical vulnerabilities, CVE-2026-86121 and CVE-2026-86124, were publicly disclosed on September 5 by the same security researcher, targeting the open-source AI agent tools Cua and AutoAgent respectively. Both flaws stem from sandbox servers that bind to all network interfaces by default while skipping authentication, allowing any network-reachable attacker to execute arbitrary shell commands without credentials. In Cua, the conflict between its local-mode auth bypass and its default 0.0.0.0 bind address exposed a shell execution endpoint, file read/write access, and an interactive PTY on TCP port 8000. Cua has already merged a fix in version 0.3.42, changing the default bind address to 127.0.0.1 and requiring an explicit opt-in for insecure exposure. AutoAgent's vulnerability remains unpatched as of the disclosure date, with its Docker setup running containers as root and mounting host directories, meaning a remote attacker could gain root-level access to real files on the host machine.