Sandbox flaw in mini-swe-agent can leak API keys to injected tasks

A vulnerability in mini-swe-agent, the lightweight coding agent from the SWE-agent project, allows attackers to steal API keys from the machine running the agent, according to an entry added to the US National Vulnerability Database on 10 October 2026.

The flaw is tracked as CVE-2026-108592 and affects versions 1.10.0 through 2.4.6. It sits in the component called BubblewrapEnvironment, which is meant to run the agent's shell commands inside a sandbox. According to the NVD description, the sandbox is launched without the --clearenv option, so commands run inside it inherit the environment of the host process rather than starting from a clean slate.

That matters because developer machines and CI runners typically hold credentials in environment variables, including the API keys the agent itself needs to call a model provider. The advisory states that an attacker who plants instructions in the task content the agent processes, a technique known as prompt injection, can make the agent read those keys out of the environment and send them out over the shared network connection available to the sandbox.

Prompt injection is the core problem here rather than a memory-safety bug. A coding agent is designed to read issue text, repository files, logs and other untrusted material, and then act on what it reads. If that material contains instructions, the agent may follow them. The sandbox is the control that is supposed to limit the damage when it does. In this case, the advisory indicates the sandbox did not strip the one thing most worth stealing.

The NVD entry points to the project's GitHub repository and to the specific sandbox source file in the v2.4.6 release, lines 38 to 103, as the location of the behaviour. It also cites a technical write-up hosted on HackMD and an advisory from VulnCheck describing the same environment exposure.

The listed sources record the issue as reported and do not include a fixed version, a patch commit, a vendor statement or a CVSS score. There is no indication in the sources that the flaw has been exploited against real users.

Operators running affected versions should treat any credential present in the environment of the agent process as potentially reachable by whatever the agent reads. The structural lesson is familiar to anyone deploying agents: a sandbox only protects what it is configured to protect, and inherited environment variables are a quiet default that crosses the boundary without anyone writing a line of code to make it happen.

The Agentic Times approached the SWE-agent project through its public repository; no response was available in the cited material.