The security of AI coding agents is currently under intense scrutiny. Security researchers at Pillar Security recently uncovered seven critical sandbox escapes. These vulnerabilities impact four major AI coding tools, namely Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. The findings were released as a seven-part research series titled “The Week of Sandbox Escapes” on July 20.
Interestingly, the AI agents did not directly break out of their sandboxes. Instead, they followed their workspace rules perfectly. However, the agents wrote specific files that trusted tools outside the sandbox later executed, loaded, or scanned. Consequently, this indirect method proves that an AI agent’s blast radius extends far beyond its isolated process.
How the AI Coding Agents Keep Escaping Sandboxes
Pillar Security’s research team reproduced these bypasses over several months. They found that modern development environments constantly run automated tools outside the sandbox. For example, Python extensions resolve interpreters, and Git integrations scan repositories.
Therefore, an AI agent can obey all its restrictions while still shaping the files these external components consume. The trigger for these escapes is often prompt injection. A malicious instruction hidden in a README, dependency, or code diff quickly becomes a real action on the developer’s machine.
The researchers grouped the failures into four distinct modes:
- Denylist sandboxes miss complex operating-system behaviors.
- Workspace configurations act as executable code.
- “Safe” command allowlists trust a program’s name without evaluating its arguments.
- Privileged local daemons operate completely outside the sandbox.
Vendor Responses & Fixes
Fortunately, vendors have already patched most of the identified vulnerabilities. Cursor fixed its affected hook, virtual-environment, and Git-metadata paths in version 3.0.0. This update includes a patch for a workspace hook vulnerability tracked as CVE-2026-48124.
Similarly, OpenAI patched a Codex CLI flaw where the “git show” command was treated as safe. The actual invocation was not read-only, which allowed attacker-controlled content to be written. This issue was resolved in Codex CLI v0.95.0, and OpenAI paid a high-severity bounty. Additionally, a shared Docker socket vulnerability affecting Cursor, Codex, and the Gemini CLI was also fixed.
Google, however, took a different approach. The company downgraded the severity of its two Antigravity findings. Google classified them as valid security issues but judged them difficult to exploit. The company argued that these attacks require social engineering or a user trusting a repository that carries an indirect prompt injection. Pillar Security quickly countered this stance. The researchers emphasized that trusting poisoned repositories is exactly the everyday risk these AI agents introduce.
The New Security Reality
Agentic tools are rapidly becoming active endpoint actors. They process untrusted inputs constantly. Therefore, they need to be monitored and governed just like any other endpoint threat.
A sandbox review must now cover what the agent can modify and which local services it can contact. Teams using coding agents should definitely treat workspace configurations and daemon access as parts of the effective execution boundary. Furthermore, they must verify versions and vendor advisories for each deployed tool.
You can read the full seven-part research series here: The Week of Sandbox Escapes.
