Docker AI Bug Lets Image Metadata Trigger Attacks

A critical vulnerability in Docker’s Ask Gordon artificial intelligence assistant allows attackers to execute malicious commands by hiding them in the container application development platform’s image metadata, said security researchers.

See Also: Proof of Concept: Bot or Buyer? Identity Crisis in Retail

Dubbed DockerDash, the vulnerability exploits a failure across Docker’s AI execution chain in which malicious instructions embedded in image metadata labels are read by the Gordon AI assistant, forwarded to executed through the model context protocol tools without validation at any stage, said Noma Labs. The flaw results in remote code execution on cloud and command-line systems or data exfiltration on desktop applications depending on permission levels.

Noma Labs reported the vulnerability to Docker on Sept. 17. Docker confirmed the issue on Oct. 13 and released mitigations in Docker Desktop version 4.50.0 on Nov. 6, though public disclosure occurred four months later. The attack works through what Noma Labs terms meta-context injection, where attackers craft Docker images containing weaponized instructions in Dockerfile label fields that appear as standard metadata but function as executable commands when processed by the AI system.

In the remote code execution scenario, an attacker publishes a Docker image with a malicious label containing instructions to list running containers and stop them. When a victim queries Ask Gordon AI about the image, the assistant reads all metadata including the embedded commands, interprets them as legitimate user directives and forwards them to the MCP Gateway. The gateway then invokes Docker’s MCP tools to execute the command sequence with the victim’s privileges.

The data exfiltration path targets Docker Desktop, where Ask Gordon operates with read-only permissions that prevent direct command execution but still allow information gathering. Attackers embed instructions that direct the AI to collect system information about installed MCP tools, container configurations, environment variables, network settings and volume mappings, then exfiltrate this data to attacker-controlled endpoints.

The trust boundary must sit at the agent level, where the AI system needs to differentiate between data to read and instructions to execute, Gal Moyal from Noma Security’s CTO office, told Information Security Media Group. “The reality is there’s no perfect signal to distinguish benign context from malicious intent because LLMs process them identically,” Moyal said. “You need runtime enforcement that understands task scope, data sources, and blast radius.”

Traditional security monitoring systems cannot detect these attacks, Moyal said. “Endpoint detection and response, or EDR, sees a docker stop command – legitimate action, legitimate credentials. It can’t see the poisoned context that made the AI execute it. The gap is structural. Conventional tools monitor infrastructure. AI attacks manipulate reasoning.”

The vulnerability extends beyond Docker to any AI system that reads files or external data, uses tool-calling frameworks and makes decisions based on loaded context. “The vulnerability isn’t Docker-specific – it’s AI-specific,” Moyal said. “GitHub Copilot reading a poisoned README, Salesforce Agentforce parsing customer data, or any RAG system ingesting documents – all vulnerable to the same attack pattern.”

David Brumley, chief AI and science officer at Bugcrowd, said DockerDash shows how companies develop AI products without checking guardrails for prompt injection. “It’s an easy exploit vector where simple malicious metadata turns into commands,” Brumley said. “DockerDash is one example of what is sure to be a slew of examples in 2026. The prompt injection vulnerable pattern is clear and growing, and not one easily caught by traditional AppSec tools.”

Ronald Lewis, senior manager of security compliance and auditing at Black Duck, said AI presents a fundamentally different attack surface than traditional systems. “While the fundamentals for evaluating an attack surface are the same, the characteristics of how we define inputs and outputs are vastly different and if not understood – pose significant risk to organizational environments,” Lewis told ISMG.

He added that AI inference creates boundaries that have become fuzzy compared to traditional systems bounded by expected constraints of object definitions, highlighting the need to evolve attack surface perception, shift risk thinking to match the non-deterministic nature of AI-borne risks, and implement controls that emphasize implicit versus explicit trust.

Docker’s mitigation strategy implements two defenses: blocking Ask Gordon from displaying images with user-provided URLs to prevent exfiltration, and requiring explicit user confirmation before executing any MCP tools to break the automated execution chain.

Moyal identified the core problem as the inability of language models to distinguish between context and instructions. “Everything loaded into the context window – trusted system prompts or untrusted README files – gets processed identically,” he said. Until AI models implement native mechanisms to parse information without treating it as directives, organizations need external controls that monitor agent behavior and enforce guardrails around access and execution capabilities.

Docker users are advised to upgrade to Desktop version 4.50.0 or later immediately to address both vulnerability paths disclosed in the research.