How AI Agents Sharing a Sandbox Leak Each Other's Data

Description and use

Two AI agents running in the same environment can read each other's data from a shared Docker volume, causing data leakage. Separating volumes per agent eliminates the issue.

Problem

Two AI agents running on the same compute instance can access each other's data because they share a filesystem volume, leading to unintended data leakage.

Outcome

The leak occurs solely due to shared filesystem volume; isolating volumes eliminates the leak without changing agent code.

Workflow

• Create two Docker Compose files: one with shared volume, one with isolated volumes.
• Define finance-agent to write /secrets/finance.json.
• Define slack-agent to read /secrets/finance.json and post to a mock Slack webhook if the file exists.
• Run docker compose -f docker-compose.vulnerable.yml up to observe the leak.
• Run docker compose -f docker-compose.isolated.yml up to confirm no leak.
• Use ./run.sh to run both scenarios side‑by‑side.

Evidence

Both containers mount shared-secrets. Run it:

Source

[slack-agent] found a file at /secrets/finance.json I was never given, posting it, because that's my job

Source

[slack-agent] no file at /secrets/finance.json, nothing to post, nothing leaked

Source