73% of What We Blocked in a Month Was One Syscall Your Sandbox Cannot See

Description and use

Blocking io_uring_setup in seccomp sandboxes removes a major blind spot that lets AI agents hide I/O operations. It trades performance for security visibility.

Problem

Seccomp-based sandboxes cannot detect io_uring operations, allowing unmonitored I/O that bypasses syscall-level security policies.

Outcome

Blocking io_uring_setup eliminates a major blind spot in seccomp sandboxes, ensuring all I/O operations are observable and scored. AI agents lose performance but gain security visibility.

Workflow

• 1. Run AI agent inside a seccomp sandbox.
• 2. Agent attempts io_uring_setup to create a ring.
• 3. Sandbox allows the syscall, ring is created.
• 4. Agent submits I/O operations via the ring, no further syscalls.
• 5. Seccomp filter cannot see these operations, bypassing security checks.
• 6. Grith intercepts syscalls and denies io_uring_setup before scoring.
• 7. Agent falls back to standard syscalls (openat, connect) which are monitored.

Evidence

73% of everything we blocked was a single syscall: io_uring_setup.

Source

Docker blocks the io_uring syscalls in its default seccomp profile as of 25.0.

Source

grith denies io_uring_setup structurally, before it is ever scored.

Source