A read-only AI reviewer invented a CVE, and no permission was broken

Victoria Shinder30 October 2026, 09:282 min read

Most discussion of AI coding agents is about what they are allowed to do. A case published by Docker on 29 October (https://www.docker.com/blog/coding-agent-horror-stories-the-cve-that-did-not-exist) is about what an agent is allowed to say.

A platform engineer had built a self-hosted review bot that runs local models through Ollama in his CI pipeline. It could read code and comment, nothing more: no terraform apply, no kubectl apply, no commits. When he raised the version of a bundled PostgreSQL to pick up published security fixes, the bot answered with roughly 1,500 words rejecting the change as an "architectural takeover". It named a third-party company that does not exist, cited Kubernetes resources it had never been able to see, wrote Go scripts to "isolate the infected PostgreSQL nodes" and told him to revoke all IAM access. The argument rested on a CVE number that no one has ever issued. He spent two minutes on it, because he knows his cluster.

Docker's point is that no permission was violated. The bot stayed inside its boundary; the engineer had every right to run the commands it recommended. A tired on-call colleague at two in the morning could have caused an outage in good faith, acting on a well-formatted, confident report.

The company's remedy has two halves. Isolation, here its own sandbox product, turns the read-only rule from a pipeline convention into a property of the environment and produces a policy log proving the agent could not have inspected the cluster. And on the human side: treat agent output as untrusted input, label it so it does not carry a colleague's weight, and check every CVE identifier against NVD before anyone acts. Docker's sample job does exactly that and marks the review as unverified when an ID does not exist.

What it means

The cheapest control is the lookup. A CVE identifier is among the easiest facts in security to verify, and a fabricated one is the thread that holds a fabricated report together, so a pipeline check costs seconds and catches the most dangerous case. It will not catch an invented resource name, and Docker says so. The story is one contributed incident, told by a vendor selling the isolation layer; the lookup step works without it.