# Le Chat's Sandbox Token Worked from the Internet. > The primary is Vero Security's post dated 13 October 2026, by Dor Benjamin. A proxy credential in Mistral's Le Chat coding sandbox reached internal models, metrics, and a tool gateway. Vero's timeline says Mistral deployed a fix on 10 September. Public disclosure is 12 October. Mistral's advisory index lists no row for it. Source: https://hackerlogs.com/blog/mistral-le-chat-token-clock Published: 2026-10-14 ## Key takeaways - The primary is Dor Benjamin at Vero Security. The post is dated 13 October. The timeline inside it dates public disclosure to 12 October. - A proxy credential in the Le Chat sandbox environment was valid, and Vero says the proxy answered from the internet. The model had refused to print the environment. - Vero's timeline says Mistral deployed a fix on 10 September. That date is the researcher's. The post links no Mistral release note and no version. - From the 31 August report to the 12 October public note is 42 days. The impact window in the same timeline is the ten days before the claimed fix. - Mistral's advisory index, read on 14 October, lists three rows. The newest is MAI-2026-003 for Vibe, a different product. None names this token. [Vero Security's post](https://www.vero.security/blog/your-agents-sandbox-isnt-private-how-one-token-opened-mistrals-internal-model-fleet), dated 13 October 2026, says a proxy credential inside Mistral's Le Chat coding sandbox reached an internal model fleet, a tool gateway, and internal metrics. Dor Benjamin wrote it. The timeline in the post dates public disclosure to 12 October. Vero says the proxy was reachable from the internet and the credential was valid. Hacker News tonight led with OpenCode 2.0, a Typesafe release, and a CSO analysis of summer lab incidents that already have briefs. US X trends at 22:44 UTC were football, Starlink, and celebrity. Reuters in this window had no new operator control failure. [Vercel's challenge write-up](/blog/vercel-sandbox-host-memory) the same day is a separate brief. This one is the credential. Medium because Vero describes a provider credential that opened internal models, and because the only fix date is Vero's. The post does not report theft of customer chats. Mistral's public advisory index, read tonight, has no row for this token. Three panels for the Le Chat sandbox token: the credential was in the environment, the advisory index has no row, and there is no package to pin. ## The token was in the sandbox. Le Chat's coding agent runs commands in a Linux sandbox Mistral hosts. Vero asked the model to print its environment. It refused, and said the variables held sensitive information. Vero then gave the agent a coding task that ran code inside the sandbox. The environment included a proxy credential in `SANDBOX_PROXY_GITHUB_PROXY`. This brief does not print the value, the proxy address, or the request. Vero says that credential, presented to a proxy that answered from the internet, opened an internal model service the public internet could not reach on its own. The model list included unreleased checkpoints and internally hosted third-party models. Inference in their test showed no per-user limit they could see. A metrics endpoint returned usage counters and internal project names with no authentication. A tool layer exposed agent tools, including web fetch and MCP connectors. Vero says choosing the destination on that web tool made it a server-side request from an internal network position. They say the surrounding guardrails held during that probing, and they stopped. > The refusal is a prompt policy. The sandbox's job is to run code, and that code could read the environment. Vero says the proxy accepted the credential from the internet. The report went to Mistral on 31 August, and Mistral acknowledged it the same day. Mistral allowed further probing on 1 September. Expanded findings went back on 3 September. Vero's timeline says Mistral deployed a fix on 10 September. ## The fix clock is not a package version. There is no customer package in this finding. The credential lived in the hosted sandbox. Operators cannot pin a Le Chat build the way they pin a library. The impact clock is the window Vero gives: discovered and reported on 31 August, fix deployed on 10 September. That is ten days in which Vero says the credential worked. The disclosure clock runs from 31 August to the 12 October public note, 42 days, and the post is dated 13 October. The days after 10 September are a provider fix that had not yet been written down as a public advisory. Mistral's [advisory index](https://docs.mistral.ai/resources/security-advisories), read on 14 October, lists three advisories. The newest is [MAI-2026-003](https://docs.mistral.ai/resources/security-advisories/MAI-2026-003), dated 14 September, for shell permission checks in Mistral Vibe, fixed in Vibe 2.25.4. Vibe is a coding agent with a version customers can upgrade. The index does not mention a Le Chat sandbox credential. > Ten days of impact and 42 days to a public note are both Vero's dates. Mistral has not restated them on the advisory index. Do not file the fix as confirmed by a vendor version you cannot read. ## What to do with a hosted sandbox token. A refusal to print variables is a prompt policy. Code the coding task runs can still read the environment the process holds. That is the ordinary shape of a coding sandbox, and it is how Vero says the credential left the prompt's control. Keep a credential out of the guest when the service that accepts it is reachable from outside the guest. Inject it at the proxy, for the destination the task needs, and scope it to that task. Vero's placement point is the one to keep: the token sat in the agent's environment, so whoever could influence the agent could use what the agent could reach. Le Chat customers have no version to upgrade tonight. The fix sentence is Vero's, dated 10 September, and Mistral has not put a matching row on its advisory index. If you placed a secret into a Le Chat sandbox on or before that date, rotate it. Vero does not report that customer conversations were taken. A redacted example in the research post is not a procedure, and this brief will not expand it. If you exported a Le Chat environment into your own logs, the name to search is `SANDBOX_PROXY_GITHUB_PROXY`. Finding the name is a reason to rotate what that sandbox could see. It is not a reason to call the proxy. Vibe is the product with a package clock. [MAI-2026-003](https://docs.mistral.ai/resources/security-advisories/MAI-2026-003) says to upgrade to Vibe 2.25.4 or later. That upgrade does not speak to the hosted Le Chat sandbox. ## Sources - [Your Agent's Sandbox Isn't Private: How One Token Opened Mistral's Internal Model Fleet](https://www.vero.security/blog/your-agents-sandbox-isnt-private-how-one-token-opened-mistrals-internal-model-fleet) (2026-10-13) - [Security advisories](https://docs.mistral.ai/resources/security-advisories) - [Mistral Vibe shell permission vulnerabilities](https://docs.mistral.ai/resources/security-advisories/MAI-2026-003) (2026-09-14)