Security researchers at Endor Labs disclosed a critical type-confusion vulnerability in isolated-vm, a widely used Node.js library that runs untrusted JavaScript inside a separate V8 isolate to keep it away from the host process. The library is a common building block for platforms that need to execute user-supplied or AI-agent-generated code safely: serverless code runners, plugin systems, and increasingly the sandboxes that let LLM agents execute generated scripts. The flaw sits in how ExternalCopy handles the transferList option: by crafting a reference chain starting from a single ivm.Reference, an attacker running code inside the supposedly isolated guest can corrupt memory in the host process, escalating from a controlled crash to full control-flow hijacking. In practical terms, code that was assumed to be contained can break out and run arbitrary commands on the machine hosting the sandbox, a full guest-to-host escape rather than a partial information leak. Because isolated-vm is embedded inside other frameworks and services rather than run directly by end users, the exposure is easy to miss in a dependency audit; teams need to check whether any service, especially AI agent execution layers or notebook and plugin runners, pulls in isolated-vm transitively. The maintainers shipped fixes in versions 6.2.0 and 7.0.1, so the practical remediation is a dependency bump plus verifying no vendored or pinned older builds remain in production. For teams building anything that runs untrusted or LLM-generated code, this is a reminder that sandbox libraries are themselves attack surface, and that memory-safety bugs in the isolation layer undermine any security model built on top of them, no matter how careful the containing application is.