Four AI coding agents hit by sandbox escapes

Security researchers have escaped the sandboxes used by four widely deployed AI coding agents: Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. The attacks do not break through the sandbox directly. Instead, the agent writes a file that a trusted tool outside the sandbox later runs, loads, or scans.

How the sandbox escapes work

Pillar Security researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel reproduced the bypasses over several months and published them today as the Week of Sandbox Escapes, a series covering one write-up per day.

The sandbox boundary assumes that the agent’s project workspace is trusted while the host system outside it is protected. But files created inside that workspace are not inert. External tools—including Python extensions, Git integrations, VS Code task runners, hook engines, and Docker Desktop—may read or execute them.

×

The trigger is often prompt injection: a malicious instruction hidden in a README, issue, dependency, or code diff. The agent can follow its sandbox rules while still modifying files that another local component later treats as trusted.

Pillar grouped its seven findings into four failure modes:

Recommended reading

Ostium loses $23.75 million in price-feed attack

• Denylist-based sandboxes that cannot keep pace with the operating system
• Workspace configuration that is actually executable code
• “Safe” command allowlists that trust a command’s name rather than its arguments
• Privileged local daemons operating entirely outside the sandbox

Patches and vendor responses

Most of the issues have been patched and acknowledged by vendors. In Cursor, a workspace-controlled .claude hook configuration enabled unsandboxed command execution. The issue is tracked as CVE-2026-48124 and was fixed in version 3.0.0.

A second Cursor flaw allowed the agent to modify a virtual-environment interpreter that the editor’s Python extension then ran during automatic discovery. A third exploited Git metadata stored somewhere other than a directory named .git, enabling execution through fsmonitor and bypassing Cursor’s path-based rules. That bug was also fixed in 3.0.0, with a CVE pending.

In Codex CLI, a command allowlist treated git show as safe by name even though the actual invocation was not read-only. OpenAI fixed the issue in v0.95.0 and paid a high-severity bounty; a CVE is pending.

A separate Docker socket issue affected Codex, Cursor, and Gemini CLI. The agents could reach a privileged local daemon, creating an unsandboxed route for code execution. That issue has now been fixed.

Google’s response to the two Antigravity findings—a macOS Seatbelt denylist bypass and a .vscode task-configuration bypass of Secure Mode—was less severe. Pillar said Google classified both as “Other valid security vulnerabilities” and downgraded them, citing the need for social engineering or a user trusting a repository containing an indirect prompt injection. Pillar said Google still rated the research highly, including feedback that one report was “of exceptional quality.”

The broader configuration problem

The underlying technique is not new. In April, Cymulate documented the same pattern—calling it “Configuration-Based Sandbox Escape”—across Claude Code, Gemini CLI, and Codex CLI. In those cases, a file written inside the sandbox ran on the host during the next launch.

Pillar’s research expands the evidence across four tools from three vendors. Its proposed mitigation is not another denylist of risky filenames, but monitoring the point at which a trusted local tool executes something written by the agent.

×