Image: Pillar Security / pillar.security Researchers Found Seven Ways to Break Out of AI Coding Agent Sandboxes. All Four Major Tools Were Hit.
Pillar Security's 'Week of Sandbox Escapes' documented attacks against Cursor, Codex CLI, Gemini CLI, and Antigravity. The core finding: sandboxing the agent doesn't sandbox its outputs.
Security researchers at Pillar Security published seven sandbox escape attacks against four widely used AI coding agents last week: Cursor, OpenAI’s Codex CLI, Google’s Gemini CLI, and Google’s Antigravity. The series ran daily from July 20 through July 26, with one write-up per day.
Every one of the seven escapes works the same way. The agent never breaks out of the sandbox directly. It writes a file inside the project workspace, and a trusted tool running outside the sandbox eventually executes that file. The sandbox contains the agent. It doesn’t contain the agent’s outputs.
Researchers Eilon Cohen, Dan Lisichkin, and Ariel Fogel from Pillar’s research team named this the “agent’s blast radius”: anything the agent can write to is part of the attack surface if something outside the sandbox will later read or run it.
Four structural weaknesses
The team identified four failure modes that showed up across all the tools:
Denylist sandboxes can’t keep pace with the operating system. Blocking specific commands, paths, or syscalls requires a complete and current model of everything dangerous. That’s not achievable. The OS grows faster than any blocklist.
Workspace configuration files are executable code. Config files like .claude hook configs, virtualenv specs, or Git attributes live inside the workspace the agent controls. If a tool trusts those files and the agent can rewrite them, the agent controls what the tool does.
Command allowlists trust names instead of full invocations. A command called git show sounds read-only. But the actual invocation can include flags or arguments that make it do more than show. Codex CLI’s allowlist treated the command name as sufficient.
Privileged local daemons sit outside the sandbox entirely. Docker daemons, build tools, and other background processes with elevated privileges often pick up files from the project directory. Writing to those files is writing outside the sandbox.
What got patched
In Cursor, researchers rewrote a .claude hook config file within the workspace to trigger arbitrary command execution. That’s CVE-2026-48124, now fixed in Cursor 3.0.0. Git metadata and virtualenv interpreter paths were also exploited in separate demonstrations.
In Codex CLI, the command allowlist trusted git show by name. OpenAI patched it in Codex CLI v0.95.0 and paid a high-severity bug bounty. A CVE is pending.
A Docker socket issue hit Codex, Cursor, and Gemini CLI simultaneously. If the agent can reach the Docker socket, it has root-equivalent access to the host. That’s not a sandbox bypass; it’s a failure to sandbox in the first place.
Google’s two Antigravity vulnerabilities were rated down by Google’s security team, which cited the social engineering requirements as a mitigating factor. The researchers published their findings regardless. Google’s team acknowledged the research quality while disputing the severity rating.
The pattern isn’t new
An earlier study by Cymulate in April documented similar sandbox bypass patterns across several tools. The Pillar research is more systematic, with more tools, more specific CVEs, and more published exploit code.
The common thread: AI coding agents are granted significant workspace access to function. That access is what makes them useful for autonomous coding tasks. But workspace access means the agent can write to files that build tools, linters, test runners, and daemons will eventually touch. None of those downstream tools are sandboxed.
Most of the specific issues found by Pillar are now patched. The structural problem stays. Sandboxing the agent is only useful if you can also sandbox everything the agent writes to.
Sources: Pillar Security Blog — BleepingComputer