Security Researchers Uncover Sophisticated Sandbox Escapes in Prominent AI Coding Agents

Security researchers have successfully bypassed the sandbox environments of four widely adopted AI coding agents, including Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. Rather than attempting a direct assault on the sandbox’s defenses, the researchers employed a more subtle strategy: manipulating files within the sandbox that are subsequently executed by trusted tools operating outside of it. This novel approach circumvents the sandbox’s perimeter by leveraging the inherent trust placed in these external execution mechanisms.

The groundbreaking findings were published by Pillar Security’s research team, comprised of Eilon Cohen, Dan Lisichkin, and Ariel Fogel. Over several months, the team meticulously reproduced and documented these bypasses, releasing their findings in a series titled "The Week of Sandbox Escapes," with a new write-up published daily. This series highlights a critical vulnerability in the security model of many AI-powered development tools, where the line between a trusted internal agent and a protected host environment is more porous than previously understood.

The fundamental premise of these sandboxes is to create a secure boundary: the AI agent operates within a designated project workspace, and the host system remains protected. However, the research demonstrates that files generated within this workspace are not inert. Tools that operate outside the sandbox, such as IDE extensions, version control system integrations, and build tools, actively read and process these files. Consequently, a file that an AI agent is permitted to write can be transformed into an executable command that the host system subsequently runs.

The Mechanics of the Sandbox Escapes

The core of the exploit lies in how integrated development environments (IDEs) and command-line interface (CLI) agents function. These systems continuously execute various tools outside the sandbox environment. This includes Python extensions that resolve interpreters, Git integrations that scan repositories for changes, VS Code that processes task files, hook engines that trigger commands, and even Docker Desktop, which exposes a local socket for communication. A sandboxed AI agent, while adhering to all its defined rules and restrictions within its confined space, can still influence the files that these external components interact with.

The initial trigger for these escapes is often prompt injection. This occurs when malicious instructions are embedded within elements that the AI agent is designed to process, such as a project’s README file, an issue tracker entry, a dependency list, or a code diff. Once injected, these instructions can lead to unintended local actions being performed on the developer’s machine, effectively breaking the isolation intended by the sandbox.

Pillar Security has categorized their seven identified findings into four distinct failure modes, illustrating the multifaceted nature of this vulnerability. These modes reveal how different components and trust relationships within development workflows can be exploited.

A Closer Look at the Vulnerabilities and Their Fixes

Fortunately, the majority of the vulnerabilities uncovered have been acknowledged by the vendors and patched.

In Cursor, one of the affected AI coding agents, a configuration file for a .claude hook was exploited. This allowed for unsandboxed command execution, bypassing the intended security measures. This specific vulnerability has been formally tracked as CVE-2026-48124 and was resolved in version 3.0.0 of Cursor.

A second vulnerability in Cursor allowed the AI agent to modify a virtual environment interpreter. The editor’s Python extension, during its automatic discovery process, then executed this modified interpreter, leading to an unintended code execution pathway.

A third exploit in Cursor leveraged the flexibility of Git metadata. By understanding that Git metadata does not strictly need to reside within a .git folder, the researchers were able to trigger execution through the fsmonitor mechanism. This bypassed Cursor’s path-based security rules. This issue was also patched in version 3.0.0, with a CVE designation pending.

For OpenAI’s Codex CLI, a vulnerability was found in its command allowlist. While the system was designed to permit specific "safe" commands, the actual invocation of the git show command was not strictly read-only. This allowed for unintended modifications or executions. OpenAI addressed this vulnerability in version v0.95.0 and awarded a high-severity bug bounty, with a CVE pending.

A significant finding that impacted multiple tools simultaneously was a Docker socket vulnerability. This issue affected Codex, Cursor, and Gemini CLI. The AI agents could access a privileged local daemon, which then served as an unsandboxed environment for running code. This critical vulnerability has since been fixed across all affected platforms.

Google’s Response to Antigravity Findings

Google’s reaction to the two vulnerabilities identified in Antigravity, their AI coding agent, was notably more reserved. The findings included a bypass of the macOS Seatbelt denylist and a bypass of the .vscode task configuration within its Secure Mode.

According to Pillar Security, Google classified both of these issues as "Other valid security vulnerabilities." They subsequently downgraded the severity, deeming them difficult to exploit. The rationale provided by Google was that these exploits would likely require social engineering tactics or a user to implicitly trust a repository containing indirect prompt injection vulnerabilities.

Despite this classification, Pillar Security noted that Google’s internal security team still highly regarded the research. They quoted feedback indicating that one of the reports submitted was "of exceptional quality," suggesting that while the immediate exploitability might be debated, the technical discovery and methodology were recognized as valuable.

An Enduring Problem with Broadening Implications

The class of vulnerabilities identified is not entirely new. In April of the same year, security firm Cymulate documented a similar pattern, which they termed "Configuration-Based Sandbox Escape." Their research also highlighted issues with Claude Code, Gemini CLI, and Codex CLI, where files written within the sandbox were executed by the host upon the next launch. This pattern underscores a persistent challenge in securing AI-powered development tools.

What distinguishes Pillar Security’s findings is the breadth of their impact. The same fundamental failure mode was observed across four distinct tools developed by three different major technology vendors. This widespread presence offers a more comprehensive and useful signal for developers and organizations evaluating the security posture of agentic coding tools. The ease with which these AI agents can influence trusted external processes presents a significant risk, especially as AI integration into software development workflows becomes increasingly prevalent.

Pillar Security’s proposed solution moves beyond simply blacklisting specific filenames or commands. Instead, their recommendation focuses on monitoring the precise moment when a trusted local tool executes something that was written by the AI agent. This more granular approach to detection and prevention is crucial for effectively mitigating these evolving threats.

The Broader Landscape of AI Security

The discovery of these sandbox escapes by Pillar Security arrives at a critical juncture in the evolution of artificial intelligence in software development. AI coding agents, such as those developed by OpenAI, Google, and Microsoft (through Cursor, which integrates with OpenAI models), are rapidly becoming indispensable tools for developers. They promise increased productivity, faster iteration cycles, and more efficient code generation. However, this rapid adoption has, at times, outpaced the development of robust security frameworks specifically designed to address the unique challenges posed by AI agents.

The concept of a "sandbox" has long been a cornerstone of computer security, designed to isolate potentially untrusted code or processes from the main system. In the context of AI coding agents, sandboxing aims to prevent malicious code generation or unintended system modifications. The success of these researchers in bypassing these sophisticated security measures suggests that the traditional understanding of sandbox limitations needs to be re-evaluated in light of advanced AI capabilities.

The vulnerabilities identified are not merely theoretical. They represent tangible risks to developers and the organizations they work for. A compromised AI agent could inadvertently introduce security flaws into production code, expose sensitive intellectual property, or even grant attackers a foothold within a development environment. The fact that prompt injection, a well-known AI vulnerability, can be weaponized in this manner highlights the interconnectedness of AI security concerns.

Implications for the Future of AI Development Tools

The implications of these findings are far-reaching for the future development and deployment of AI coding assistants. Firstly, it necessitates a more rigorous and security-centric approach to the design and implementation of these tools. Vendors must move beyond basic sandboxing and invest in more sophisticated security architectures that account for the complex interactions between AI agents and their host environments.

Secondly, it underscores the importance of continuous security research and auditing. As AI technology evolves, so too will the methods used to exploit it. Independent security researchers and bug bounty programs play a vital role in identifying and mitigating these emerging threats before they can be widely exploited. The "Week of Sandbox Escapes" series exemplifies the value of such transparent disclosure.

Thirdly, developers themselves need to exercise a higher degree of caution and skepticism when using AI coding tools. Understanding the potential risks associated with prompt injection and being vigilant about the source and content of AI-generated code are essential practices. Educating development teams on these new security paradigms is crucial for fostering a secure AI-powered development culture.

The classification of some vulnerabilities by Google as less severe due to the need for social engineering or user trust raises an important debate. While direct, autonomous exploitation might be challenging, the reality of software development often involves human interaction and trust within teams and with external collaborators. Therefore, vulnerabilities that can be triggered through social means or by exploiting existing trust relationships should not be underestimated. The security of development pipelines is a complex ecosystem, and a weakness in one area can cascade into significant breaches.

The findings by Pillar Security serve as a critical reminder that the race to innovate with AI must be balanced with a commitment to security. As AI agents become more integrated into the core functions of software development, ensuring their integrity and the security of the environments they operate within is paramount. The industry must collectively learn from these incidents and proactively build more resilient and secure AI-powered development platforms. The path forward requires collaboration between researchers, vendors, and the developer community to stay ahead of evolving threats and ensure that the benefits of AI in coding are realized without compromising security.