Security Researchers Expose Sandbox Escape Vulnerabilities in Major AI Coding Agents
Key Takeaways
- ▸Sandbox escape vulnerabilities identified across 4 AI coding agents from 3 major vendors using a unified attack vector: trusted tools outside the sandbox reading files the agent wrote inside
- ▸Vulnerabilities do not require breaking the sandbox directly—agents can obey all sandbox rules while enabling privilege escalation through workspace file manipulation
- ▸Most vendors have patched or acknowledged issues with CVE tracking and bounty payments; Google uniquely downgraded severity due to perceived exploitation difficulty
Summary
Security researchers at Pillar Security discovered sandbox escape vulnerabilities in four widely used AI coding agents: Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Antigravity. Rather than attacking the sandbox directly, the researchers exploited a fundamental architectural flaw: sandboxed agents are trusted to write files inside the workspace, but tools running outside the sandbox (Python extensions, Git integrations, VS Code tasks, Docker daemons) read and execute those files, allowing a compromised agent to trigger unsandboxed code execution.
Pillar's research team, led by Eilon Cohen, Dan Lisichkin, and Ariel Fogel, identified four failure modes: denylist sandboxes that cannot keep pace with OS changes, workspace configurations that double as executable code, "safe" command allowlists that trust command names rather than arguments, and privileged local daemons operating outside sandbox boundaries. Specific findings included Cursor's .claude hook config vulnerability (CVE-2026-48124, patched in v3.0.0), virtualenv editor exploitation, Git metadata bypasses, and a Docker socket issue affecting multiple tools.
Most vendors have acknowledged and patched the vulnerabilities. OpenAI released fixes in Codex CLI v0.95.0 with a high-severity bounty, while Google downgraded the severity of its Antigravity findings as "difficult to exploit," though praising the research quality. This research highlights a systemic issue: the same failure pattern was independently documented by Cymulate in April across Claude Code, Gemini CLI, and Codex CLI, suggesting the problem is widespread rather than isolated.
- Pillar's research reveals a systemic architectural pattern ("Configuration-Based Sandbox Escape") previously identified by Cymulate, indicating a broader design challenge in AI coding agent security
- Solutions require monitoring the boundary where trusted local tools execute code written by the agent, not just banning filenames
Editorial Opinion
This research exposes a critical architectural tension in AI coding agents: sandboxes must grant agents enough file-write access to be useful (generating code, configs, hooks), yet tools outside the sandbox inevitably read and execute those files without verification. The fact that identical failure modes appear across independent vendors suggests this isn't a series of implementation bugs but a fundamental design challenge. While patches are rolling out, the broader lesson is that sandbox-based security for developer tools requires careful choreography between isolated and trusted components—something that cannot be secured by denylist rules alone.
