Security brief

DockerDash research used image metadata to redirect Ask Gordon tool actions

REVIEW

Noma’s reported chain crossed from untrusted image labels into privileged assistant tooling; Docker shipped a fix in 2025.

Published 29 Oct 2026 · Material update 3 Feb 2026 — last time the underlying evidence changed · Evidence: medium

What happened

February 2026 reporting described DockerDash, Noma Labs’ prompt-injection research involving Docker’s Ask Gordon assistant. A malicious image metadata label could be interpreted as instructions and passed through connected MCP tooling.

The reported chain enabled unintended code execution or data access through the surrounding tool environment. It was not a claim that every Docker image was malicious or that ordinary container metadata should be trusted as user intent.

The report identifies Docker Desktop 4.50.0, released in November 2025, as the fix. Use a currently maintained release and review which actions the assistant can perform when inspecting untrusted images. Keep image content separate from approval to execute tools.

Read the original source.

Next step

Update Docker Desktop and review assistant access to privileged MCP tools.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references