![\"sandbox\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/07\/sandbox-escape.jpg\")
<\/p>\n<\/p>\n
Security researchers broke out of the sandboxes in four widely used AI coding agents, including Cursor, OpenAI’s Codex, Google’s Gemini CLI and Antigravity, without attacking the sandbox head-on.<\/p>\n
The agent stays inside the box and follows every rule. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own.<\/p>\n
How the escapes work<\/p>\n
Pillar Security’s research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes<\/a>, one write-up a day.<\/p>\n These sandboxes draw a simple line: the agent is trusted inside the project workspace, the host outside is protected.<\/p>\n The catch is that files inside the workspace are not inert. Tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs.<\/p>\n IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, Docker Desktop exposing a local socket.<\/p>\n A sandboxed agent can obey every rule it is given and still shape the files those components read.<\/p>\n Prompt injection is the trigger. A malicious instruction planted in a README, an issue, a dependency or a diff becomes a local action on the developer’s machine.<\/p>\n Pillar sorts the seven findings into four failure modes:<\/p>\n denylist sandboxes that cannot keep pace with the operating system
Most of the issues are patched and vendor-acknowledged.<\/p>\n In Cursor, a workspace-controlled .claude hook config turned into unsandboxed command execution. It is now tracked as CVE-2026-48124<\/a> and was fixed in version 3.0.0.<\/p>\n A second Cursor bug<\/a> let the agent edit a virtualenv interpreter that the editor’s Python extension then ran on its own during discovery.<\/p>\n A third abused the fact that Git metadata does not have to live in a folder called .git, firing execution through fsmonitor and slipping past Cursor’s path-based rules. It was patched in 3.0.0, with a CVE pending.<\/p>\n In Codex CLI, a “safe”\u00a0command allowlist trusted git show by name while the actual invocation was not read-only. OpenAI patched it in v0.95.0 and paid a high-severity bounty, with a CVE pending.<\/p>\n One Docker socket finding hit Codex, Cursor and Gemini CLI<\/a> at once. A privileged local daemon the agents could reach became an unsandboxed place to run code. That issue is now fixed.<\/p>\n Google downgrades its two<\/p>\n Google’s response to the two Antigravity findings, a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode, was cooler.<\/p>\n According to Pillar, Google classified both as “Other valid security vulnerabilities” and applied a downgrade, judging them difficult to exploit because they need social engineering or a user trusting a repository that carries an indirect prompt injection.<\/p>\n Pillar says, however,\u00a0Google’s team still rated the work highly, quoting feedback that one report was “of exceptional quality.”<\/p>\n An old problem, a wider one<\/p>\n The underlying class is not new. In April, Cymulate documented<\/a> the same pattern, which it named “Configuration-Based Sandbox Escape,” across Claude Code, Gemini CLI and Codex CLI, where a file written inside the sandbox runs on the host at the next launch.<\/p>\n What is new is the breadth. The same failure shows up across four tools from three vendors.<\/p>\n Pillar’s fix is not another list of banned filenames. It watches the moment a trusted local tool runs something the agent wrote.<\/p>\n For anyone weighing agentic coding tools, that is the more useful signal: not whether an agent has a sandbox, but what happens to the files it leaves behind.<\/p>\n![\"image\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/07\/1783778360_473_ti-97.jpg\")
<\/a><\/p>\n![\"What](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/07\/pillar-sec-exploit-chain.jpg\")
The agent stays sandboxed, but the files it writes are trusted by tools outside the box
\n(Pillar Security)<\/p>\n
\n\tworkspace config that is really executable code
\n\t“safe” command allowlists that trust a command’s name rather than its arguments, and
\n\tprivileged local daemons that sit outside the sandbox entirely.
\nThe bugs, and the fixes<\/p>\n
![\"article](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/07\/bas-report.jpg\")
<\/a><\/p>\n