If you are letting users run agents and install random software then full access to the execution environment is basically a guarantee. This is why sandboxes exist. Breaking out of the sandbox would be bounty-worthy.

This seems like it’s barely a bug. Of course the files in the agent environment are not secret.

the VM is for the user to use as they see fit. you can just tell it to install apps and run builds in the VM. I don't think this deserves a bounty unless he used it to escape the vm (which he says he didn't)

> exfiltrating the entire content of the system

Since the contents of every session is owned by the user including the outputs, I am curious if the user now owns all the files given to them.

Nope this makes sense. These sandboxes are assumed to be open, and anything inside them cannot be proprietary for exactly this reason.

It's available in the app's UI file explorer lol. You don't need to ask the agent to send it. Although did I ask it to install syncthing on its VM to my machine? Why yes I did.

yeah, i was kind of surprised, but both the bounty program and the employees didn't qualify it as a vulnerability.

What's the bug? "Getting a copy of the sandbox files you can already ask for in a session"? Not a single file here is sensitive or meant to stay hidden, it's just the sandbox. You set those up yourself if you're running local models, too, there is no secret sauce here.

It's not meant to be private, in fact most of these markdown files are viewable and editable from the app itself without needing to prompt for it.