News
Pillar Security Researchers: AI Coding Agents Escape Sandboxes Without Breaking Any Rules
Pillar Security described a series of sandbox escapes in four popular AI coding agents - Cursor, Codex, Gemini CLI, and Antigravity. The agent didn't need to break any rule; it just had to write a file that a trusted program outside the sandbox would run on its own.
Contents
Researchers at Pillar Security showed that the four most popular AI-based coding agents can be induced to operate outside their designated security sandbox, even though none of its rules are formally broken. All it takes is for the agent to write the right file, and a trusted program running outside the sandbox will run it, load it, or scan it on its own.
Four Ways Around the Rules
The Pillar Research team worked on the topic for several months and described its findings in a series of articles titled "The Week of Sandbox Escapes," published day by day on DevOps.com and other industry outlets. The key finding: in nearly every case, the agent didn't need to break the sandbox directly, it just had to write something that a trusted component outside the sandbox later executed.
In almost every case, the agent didn't need to directly break out of the sandbox. It just had to write something that a trusted component outside the sandbox later executed - Eilon Cohen, Dan Lisichkin, Ariel Fogel, Pillar Security
The researchers cataloged four recurring failure patterns. The first is blacklist-based sandboxes that fail to keep up with the growing complexity of operating systems. The second is project configurations, such as workspace settings files, that are effectively executable code even though no one treats them that way. The third is command allowlists that check only the command name rather than its full invocation with arguments. The fourth is privileged local services, such as system daemons, that operate entirely outside the sandbox's reach even though the agent can freely communicate with them.
How the Specific Attacks Worked
In Google Antigravity's case, the researchers exploited weaknesses in macOS's Seatbelt profile and VS Code task configurations to operate outside the sandbox's boundaries. Cursor turned out to be vulnerable to as many as three independent techniques: interpreter manipulation in Python virtual environments, bypassing Git metadata via the fsmonitor mechanism, and code execution through hook configuration in the .claude directory, which Cursor patched in version 3.0.0 under CVE-2026-48124.
OpenAI's Codex CLI, meanwhile, had a problem with its so-called safe Git command allowlist - the agent could change the repository configuration so that a seemingly harmless command would actually run arbitrary code. OpenAI fixed the bug in version 0.95.0 and paid a high bug bounty reward for the report. The most universal problem turned out to be the Docker socket: Cursor, Codex CLI, and Gemini CLI shared the same attack vector through the privileged Docker Desktop daemon, accessible from outside the sandbox boundaries of each tool.
Prompt Injection as the Entry Point
The mechanism that kicks off the whole sequence is usually a prompt injection, a malicious instruction hidden in a README file, a bug report, a project dependency, or a code diff that the agent reads as part of its normal work. The agent, following its sandbox's rules, writes a file that is later, already outside those boundaries, run, loaded, or scanned by another trusted process on the same machine.
Google responded to two reports concerning Antigravity but classified them as difficult to exploit in practice. The company's security team nonetheless praised the quality of the researchers' report. This isn't the first time someone has described this pattern - Cymulate documented a similar mechanism back in April, calling it a "configuration-based sandbox escape." The fact that the problem recurs across different vendors suggests this isn't a single bug but a systemic gap in how coding agents' security is designed.
What This Means for Companies and Developers
For development teams in Poland increasingly relying on coding agents in their daily work, the conclusions from Pillar Security's research are concrete. A sandbox alone doesn't protect against the consequences if the agent can write a file that's later read by a process running with full privileges on the same machine. Project configurations, hooks, workspace settings, and environment files need to be treated as potentially executable code, not harmless data.
The researchers recommend that organizations require explicit approval for changes to project configuration files, ensure that helper processes operate under the same security policies as the agent itself, preserve information about file provenance, model policies around the side effects of commands, restrict access to privileged local services, and monitor the moments when trust passes from the agent to another process.
This is another voice in a growing body of research showing that the popularity of coding agents is outpacing the speed at which vendors can secure the infrastructure around them. Cursor, Codex, Gemini CLI, and Antigravity are among the most widely used tools of this kind today, and the vulnerabilities uncovered involved mechanisms present in the default configuration, not some rarely used experimental mode.
