Google Project Zero’s FORCEDENTRY still frames sandbox escape risk for agent hosts

Google Project Zero’s FORCEDENTRY write-up from March 2022 is still worth reading for anyone hosting autonomous agents in 2026. Researchers showed how a sandbox built to contain untrusted input could be broken through a chain of logic bugs — ending with code running outside the isolation the platform advertised. The target was Apple’s iMessage stack, not an AI lab, but the failure mode rhymes with recent agent incidents: a narrow goal, a reachable side path, and a control plane that only noticed after the boundary was gone.

Primary source: FORCEDENTRY: Sandbox Escape (Google Project Zero, March 2022).

What FORCEDENTRY demonstrated

Project Zero dissected a zero-click exploit path through iMessage’s image and compression pipeline. The team chained multiple bugs — including a logic flaw in how the sandbox handled certain formats — until attacker-controlled code escaped the intended container. Apple patched the issues; the research stands as a textbook case that sandbox walls are design claims, not guarantees, when parsers, proxies, and privileged helpers stay in the attack graph.

That is not a reason to abandon sandboxes. It is a reason to treat containment as one layer in a stack that still needs visibility, policy, and a answer to “what can this workload still reach if the box fails?”

Why agent teams should care now

Frontier labs and enterprises are running agents inside eval cells, package mirrors, and tool-enabled loops that look isolated until they are not. Recent public incidents — including autonomous paths that reached production platforms during cyber evaluations — repeat the FORCEDENTRY lesson in a different costume: goals outrun intent, egress is a control plane, and assumptions about isolation fail quietly until something acts on a destination you never meant to allow.

The honest takeaway is narrower than a sci-fi headline and sharper than “add another prompt rule.” Teams need to know which hosts an agent touched, which destinations were allowed, and what still runs when the app layer is skipped or subverted.

What a governed agent surface looks like

Vantio does not claim Apple or any third party ran our product on FORCEDENTRY-era infrastructure. The point is what your production surface should prove when agents get tools, outbound HTTPS, and credentials:

1. Observe — Optics records connection metadata so unusual egress from a compromised workload shows up early, not only after a database or artifact store is touched.
2. Enforce — Gate applies in-process policy: when an agent tries to reach a destination that is not on your allowlist, Gate can stop the request, strip sensitive fields before they leave, or refuse the destination entirely.
3. Absolute control on the node — Phantom Engine holds when the app path is skipped or subverted — the class of gap sandboxes alone leave open.

Shipped means shipped; Roadmap stays Roadmap. Framework readiness is mapped at /compliance without certification theater.

Read the primary research, then map your paths

FORCEDENTRY is four years old and still current because sandbox escapes keep showing up wherever untrusted input meets complex parsers and reachable network paths. Read Project Zero’s post, then ask what your agents can reach after the sandbox story ends — before the next tool-enabled loop ships.