73% of What We Blocked in a Month Was One Syscall Your Sandbox Cannot See (grith.ai)

A recent analysis of AI coding agents using a security proxy called grith revealed alarming insights about system call vulnerabilities. Over the course of a month, 2,129,319 system calls were intercepted, with 73% of blocked events stemming from a single syscall: io_uring_setup. This syscall is particularly concerning because traditional seccomp-based sandboxes, which assess system calls made by applications, fail to monitor the operations that follow an io_uring setup, effectively creating a blind spot for security measures. Consequently, when the agents attempted to use io_uring—137 times during sessions with Claude Code and Codex—a total of 13,613 attempts were denied, emphasizing the critical need for robust monitoring around this interface. The significance of these findings extends into the broader AI/ML community as it directly informs security protocols for running AI agents. The clear consensus is that despite io_uring's advantages in I/O performance, it poses a security risk that cannot be overlooked. Both Docker and containerd have since adopted default settings that block io_uring-related syscalls, reflecting industry-wide acknowledgment of the vulnerabilities associated with asynchronous I/O operations. For those utilizing AI agents in protective environments, these findings underline the importance of ensuring that any sandbox is configured to disallow io_uring use, thus safeguarding against potential breaches that could compromise sensitive operations.