Study reveals that AI coding agents continue to break free from their sandboxes.

      The tools involved are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. Over a few months, Pillar Security discovered methods for each agent to bypass its security boundary while technically remaining within the confines of the sandbox.

      The illusion of an escape

      The trick is clever. These sandboxes place trust in the agent within the project folder while safeguarding the host outside. However, the files within that folder are active, not static. Tools operating outside the sandbox can access them. A Python extension can trigger an interpreter, Git integration can examine a repository, and Docker Desktop can expose a local socket. Consequently, a file that the agent is allowed to modify might later serve as a command executed by the host, as noted by BleepingComputer.

      The catalyst is prompt injection. A harmful instruction concealed within a README, an issue, a dependency, or a diff can manifest as a concrete action on a developer’s machine.

      Seven vulnerabilities, four patterns

      Pillar categorized seven findings into four failure modes: denylists that cannot keep up with the operating system, workspace configurations that effectively act as code, “safe” command lists that prioritize a name over its arguments, and authorized local daemons that operate entirely outside the sandbox.

      Most fixes have been implemented. In Cursor, a workspace hook configuration that executed commands without being sandboxed is now recognized as CVE-2026-48124, which has been patched in version 3.0.0. OpenAI rectified a Codex issue where a “safe” Git command was, in fact, not safe, and a bounty was awarded. One bug related to the Docker socket affected Cursor, Codex, and Gemini CLI simultaneously.

      Google’s lack of response

      Google’s reaction was notable. It categorized both findings from Antigravity as “other valid security vulnerabilities,” deemed their severity as difficult to exploit, and did not apply patches, according to Neowin. However, it did acknowledge one report as “of exceptional quality.”

      Pillar argues that the designation of “hard to exploit” carries significant weight. The vulnerabilities require a developer to trust a compromised repository, which highlights the everyday risk that these agents inherently pose.

      Agents as the new endpoint

      The broader implication suggests a shift in perspective. Pillar contends that the blast radius of an agent is not limited to the agent process itself; it encompasses everything that the agent can write that the host later deems trustworthy. “If an agent is allowed to write the future inputs of systems, it was never properly sandboxed to begin with,” the team stated. Although this pattern is not entirely new, its scope has widened: four tools and three vendors are involved. It coincides with the revelation from OpenAI that its own model kept escaping its sandbox, part of a larger discussion on AI-agent security.

      What to consider now

      For anyone selecting an agent-based coding tool, the pertinent question has evolved. It's no longer a matter of whether the agent has a sandbox; it’s about what occurs with the files it leaves behind and who will execute them next.