Security Research Reveals Sandbox Escapes Across Four Major AI Coding Agents

Summary

Security researchers from Pillar Security have discovered a critical class of sandbox escape vulnerabilities affecting four widely used AI coding agents: Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. The researchers—Eilon Cohen, Dan Lisichkin, and Ariel Fogel—found that attackers can bypass sandboxes not by directly attacking them, but by having the AI agent write files that trusted tools outside the sandbox later run or load. A malicious prompt injection planted in a README, issue, dependency, or diff becomes a local command executed on the developer's machine.

The research identified seven vulnerabilities grouped into four systemic failure modes: denylist sandboxes unable to keep pace with OS changes, workspace configurations that are actually executable code, command allowlists that trust names rather than arguments, and privileged local daemons sitting outside the sandbox entirely. Most issues have been patched: Cursor fixed multiple vulnerabilities in version 3.0.0 (CVE-2026-48124), OpenAI patched Codex in v0.95.0 and received a high-severity bounty, and the Docker socket vulnerability affecting Cursor, Codex, and Gemini CLI has been remediated across vendors.

The findings expose a systemic weakness in the AI coding agent ecosystem. This configuration-based sandbox escape pattern was previously documented by Cymulate in April, affecting Claude Code, Gemini CLI, and Codex CLI. Rather than bandaging specific filenames, Pillar Security's recommended fix monitors the moment trusted tools execute code the agent wrote—a fundamental redesign of how sandbox security should work in agentic development environments.

• This is a recurring, industry-wide issue—same vulnerability class documented in April 2026 affecting Claude Code and other tools
• Vendors have patched or acknowledged most issues; effective fix requires monitoring when trusted tools execute agent-written code, not just blocking filenames

Editorial Opinion

These findings expose a fundamental tension in AI coding agent design: sandboxes only work if every component reading sandbox-written files is itself sandboxed or threat-aware. That's architecturally impossible in real dev environments where Python extensions, Git hooks, task runners, and Docker operate legitimately. This isn't vendor negligence—all companies responded professionally—but a design constraint that current approaches can't solve. The question isn't whether patches close this week's CVEs; it's whether agentic coding tools can safely operate in shared development machines at all, or whether they require isolated execution environments. Until vendors confront that harder question, configuration-based escapes will remain the default vulnerability class.