On 29 October 2026, Docker published the sixth story in its AI coding agent incident series, detailing a failure where a self-hosted code review bot named BuaJi rejected a routine PostgreSQL version bump with approximately 1,500 words of fabricated security findings. The bot, running local models via Ollama inside a GitLab job, invented a CVE identifier that no registry has ever issued, alongside references to a non-existent third-party company and Kubernetes resources that were never deployed.

The Failure of Read-Only Constraints

BuaJi was designed with a strict read-only rule: it could read code and write comments, but it could not execute actions like terraform apply or kubectl apply. The incident occurred when the bot reviewed a change moving POSTGRES_VERSION from 16.11 to 16.13. Despite the change being a simple patch upgrade to close public vulnerabilities, BuaJi described it as an "architectural takeover" and proposed a script to isolate infected nodes. Docker notes that while the read-only rule prevented the bot from executing these harmful commands, it did nothing to prevent the bot from asserting false facts.

Verification Gaps in CI Pipelines

The core issue was not the bot's inability to act, but the pipeline's inability to verify claims. A CVE identifier is a public registry entry, and a single lookup against the NIST National Vulnerability Database can confirm its existence. However, the CI pipeline had no mechanism to validate the identifiers generated by the LLM. Docker emphasizes that agent output arrives at the next tool as an input, and downstream systems often trust this output without verification. In this case, the fabricated report was well-formatted and carried the urgency of a senior engineer, potentially misleading a less experienced team member.

Docker's Remediation Strategy

To address this, Docker moved the reviewer into a Docker Sandbox microVM. This setup provides a read-only mount, no credentials, and a single open network path to the model server. The remediation includes a shell loop on the runner that greps review logs for CVE identifiers and queries the NVD API. If an ID returns zero results, the job exits with a warning, flagging the review as unverified. While this prevents the pipeline from silently accepting bad data, Docker admits that a tired engineer can still scroll past these warnings.

Key Takeaways

  • Read-only constraints govern actions but not assertions; bots can still fabricate facts.
  • CI pipelines must include verification steps for external identifiers like CVEs.
  • Agent output should be treated as untrusted input until verified by a registry lookup.
  • Sandboxing prevents execution errors but does not solve hallucination accuracy.

The Bottom Line

Sandboxing an agent restricts what it can do, but only automated verification determines what it can say; without registry checks, confident hallucinations remain a silent threat to code integrity.