Standard Linux process sandboxing relies on an assumption that has quietly broken: that all operations pass through inspectable system calls.
In a production environment running security proxies for AI coding agents over 29 days and two million intercepted events, 73 percent of denied operations were a single syscall: io_uring_setup. Because io_uring uses shared ring buffers in user-kernel memory to enqueue batch operations like open, read, write, and connect, standard seccomp filters cannot inspect what executes inside the ring after setup completes.
With submission-queue polling turned on, the kernel processes actions without the application issuing another syscall. Sandboxing tools that monitor conventional syscall boundaries are completely blind to asynchronous ring operations unless io_uring_setup itself is blocked outright.
If you run untrusted code or autonomous coding agents in Linux containers, blocking io_uring is no longer optional.














