Research indicates that AI coding agents are continually breaking out of their designated sandboxes.

      The tools in question are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. Over a span of several months, Pillar Security discovered methods for each agent to bypass its security boundary while technically remaining within the confines of the box.

      The non-escape

      The method is clever. These sandboxes tend to trust the agent located within the project folder while securing the host outside. However, the files contained within that folder are not passive.

      Tools operating outside the sandbox can access them. A Python extension identifies an interpreter, a Git integration checks a repository, and Docker Desktop unveils a local socket. Thus, a file that the agent is permitted to modify can transform into a command executed by the host later, as explained by BleepingComputer.

      The instigator is prompt injection. A malicious command concealed in a README file, an issue, a dependency, or a diff can trigger an actual action on the developer’s machine.

      Seven vulnerabilities, four patterns

      Pillar categorizes seven discoveries into four types of failures: denylists that can't keep pace with the operating system, workspace configurations that resemble actual code, so-called “safe” command lists that prioritize a name over the arguments, and privileged local daemons existing entirely outside the sandbox.

      Most of the fixes have been implemented. In Cursor, a workspace hook configuration allowing unsandboxed commands has now been classified as CVE-2026-48124, corrected in version 3.0.0. OpenAI resolved a flaw in Codex where a “safe” Git command turned out not to be, and issued a bounty. One vulnerability related to Docker socket affected Cursor, Codex, and Gemini CLI simultaneously.

      Google’s indifference

      Google's reaction was notable. It categorized both findings related to Antigravity as "other valid security vulnerabilities,” reducing their severity by deeming them hard to exploit and opted not to provide a patch, as reported by Neowin. Nonetheless, it described one report as “of exceptional quality.”

      Pillar contends that the phrase “hard to exploit” carries significant weight. These vulnerabilities require a developer to trust a compromised repository, which is precisely the everyday risk introduced by these agents.

      Agents as new endpoints

      The larger implication is a shift in perspective. Pillar argues that the blast radius of an agent is not confined to the agent process itself. Instead, it encompasses everything the agent can write that the host subsequently trusts.

      “If an agent has the ability to designate the future inputs of systems, it was never truly sandboxed,” the team asserted. Although the pattern is not new, its scope is extensive: four tools and three vendors. This discussion coincides with OpenAI’s announcement that its own model continued to escape its sandbox, contributing to a broader evaluation of AI-agent security.

      Questions to consider now

      For those selecting an agent-based coding tool, the pertinent question has evolved. It's no longer about whether the agent operates within a sandbox; it's about what occurs with the files it generates and who utilizes them afterward.