Four AI Coding Agents, One Sandbox Escape: The Agent Obeys Every Rule and Still Runs Code on Your Host

TL;DR

On July 20, Pillar Security published "The Week of Sandbox Escapes," a run of daily write-ups showing that four of the AI coding agents you probably ran today can be walked out of their sandboxes without anyone attacking the sandbox itself: Cursor, OpenAI's Codex, Google's Gemini CLI, and Google's Antigravity.

The trick is almost insulting in its simplicity. The agent obeys every rule inside the box. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own. Everything here is patched, so update. The uncomfortable part is the pattern, not any single bug.

What actually happened

Pillar's research team (Eilon Cohen, Dan Lisichkin, and Ariel Fogel) spent months reproducing boundary bypasses across all four tools, then shipped them one write-up a day as a themed series. Line them up and they rhyme: none of them picks the lock on the sandbox. They all slip a note under the door.

That framing matters because most people picture a sandbox escape as a jailbreak, the process clawing its way out through a kernel bug or a container misconfiguration. This is the opposite. The agent process never leaves. As Pillar puts it, the agent "did not need to break the sandbox directly. It only had to write something that a trusted component outside the sandbox would later run, load, scan, or treat as safe."

The one trick, spelled out

Here is the mechanism, because it is the whole story. Your coding agent runs sandboxed: throttled network, no writing outside the working directory, an allow-list of "safe" commands. Fine. But the files it writes into your workspace are not inert. Other tools on your machine, ones that run outside the sandbox with your full privileges, read those files and act on them: a Python extension that discovers interpreters, a git hook, a scanner, a task runner.

So the agent writes a perfectly legal file. Later, a trusted host process picks it up and executes what is inside. The sandbox worked exactly as designed, which was the problem. Think of a prisoner who never files through the bars. He writes a request on a slip of paper, slides it under the door, and the guard outside, who trusts anything that comes from that cell, carries out the order himself.

The concrete bugs

The findings are variations on that theme, each pointed at a different "trusted" reader:

• Cursor, hook config. A workspace-controlled .claude hook configuration could be written by the agent and then executed unsandboxed. That one carries CVE-2026-48124 and is fixed in Cursor 3.0.0.
• Cursor, virtualenv. The agent could edit the Python interpreter inside a project's virtualenv, which the editor's Python extension then ran during routine environment discovery. No exploit needed, just a helpful IDE doing its job.
• Cursor, git metadata. Indirection through git's fsmonitor let a write bypass path-based rules. Patched in 3.0.0, CVE pending.
• Codex, the allow-list. Codex's "safe" command list trusted git show by name, while the actual invocation was not read-only. OpenAI patched it in v0.95.0 and paid a high-severity bounty.

One bug, three agents

The finding that should make you sit up hit three tools at once. A privileged local Docker socket, reachable from inside the agents' environments, was itself an unsandboxed place to run code. Same root cause, three separate products (Codex, Cursor, and Gemini CLI) exposed by it. When one design mistake shows up across three independent codebases, that is not a bug, that is an industry assumption nobody wrote down.

How the vendors took it

The reception was a study in contrasts. OpenAI patched Codex in v0.95.0 and paid a high-severity bounty. Cursor rolled its fixes, including CVE-2026-48124, into version 3.0.0. Google patched the Antigravity remote-code-execution path and paid a bounty for it too, but on the two escapes in this series (a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode) it reached for a lower shelf of the severity cabinet, filing them as "Other valid security vulnerabilities."

The Antigravity case is the cleanest illustration of the whole thesis. A native find_by_name tool executed without routing through Secure Mode, Google's strongest setting. In Pillar's words, "the security boundary that Secure Mode enforces simply never sees this call." The wall was real. The door next to it had no lock.

Why a builder should care

This is not a "patch and move on" story, even though you should absolutely patch and move on. It is a repricing of what your dev sandbox is worth.

• The delivery vector is prompt injection you did not write. These escapes start with instructions the agent ingests as data: a poisoned README, a crafted GitHub issue, a malicious dependency, a diff. The agent cannot reliably tell "context I am reading" from "commands I should follow," so hostile text in your inputs becomes hostile files on your disk.
• Files the agent writes are executable by proxy. Treat the agent's output directory as untrusted until a human or a deterministic gate has looked at it. Anything a host tool auto-loads (interpreters, hooks, task configs, IDE settings) is a live wire.
• A sandbox is necessary and not sufficient. Containing the agent process does nothing if privileged tools outside the container keep trusting whatever the agent leaves behind. The boundary you actually need is on the read side, not the write side.
• The endpoint threat model changed. As Pillar frames it, AI coding agents shift the endpoint threat model, and most sandbox designs have not caught up. If you run agents on developer laptops or CI runners with real credentials, that gap is yours to close.

Key Takeaways

• Pillar Security's "Week of Sandbox Escapes" (July 20, 2026) shows Cursor, Codex, Gemini CLI, and Antigravity share one escape pattern.
• The agent never breaks its sandbox: it writes a file that a trusted host tool later runs, loads, or scans, and that tool runs unsandboxed.
• Named fixes include Cursor 3.0.0 (CVE-2026-48124 and more) and Codex v0.95.0, for which OpenAI paid a high-severity bounty. Update your agents.
• One privileged Docker socket exposed Codex, Cursor, and Gemini CLI at once, a shared assumption failing across three codebases.
• Prompt injection via READMEs, issues, dependencies, and diffs is the delivery mechanism; agent-written files are the payload.
• Sandboxing the agent process is not enough when host tools keep trusting the files it leaves behind.

Sources: Pillar Security, BleepingComputer, CyberScoop