In a significant revelation for the AI coding tool landscape, researchers at Pillar Security have demonstrated how four leading AI-powered coding agents—Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity—can be made to escape their security sandboxes without technically breaking them. Over several months, the team uncovered vulnerabilities that exploit a fundamental trust assumption: that files written by the agent inside the sandbox are safe, while the host system outside is protected. The trick lies in how host tools interpret those files.
These agents typically operate within a sandboxed environment—a restricted workspace that isolates the agent's actions to a specific project folder. The idea is to allow the agent to read, write, and execute code only within that folder, preventing it from affecting the broader operating system. But the files in that folder are not inert. Tools running outside the sandbox, such as Python interpreters, Git integrations, Docker Desktop, and local daemons, actively read and act upon them. A malicious instruction hidden in a README, an issue, a dependency, or a diff can turn into a real command executed on the developer's machine. This is prompt injection at its most dangerous: the agent is tricked into writing a file that the host later runs, crossing the security boundary without ever triggering a sandbox violation.
Pillar Security classified seven distinct bugs into four failure patterns. The first is denylists that cannot keep pace with the operating system. For example, an agent may be prevented from creating files with certain names or extensions, but an attacker can use symbolic links or alternative path representations to bypass the list. The second pattern involves workspace configuration files that are actually code. Many tools allow custom workspace hooks—scripts that run when a project is opened. If an agent can write a configuration file that defines a hook, that hook executes outside the sandbox with full privileges. Cursor's workspace hook feature, for instance, allowed unsandboxed command execution, tracked as CVE-2026-48124, and was patched in version 3.0.0.
The third failure mode is trusting command names over their arguments. An agent may be allowed to run a list of "safe" commands like git, ls, or cat. But a command's arguments can be manipulated to perform unintended actions. In one case involving OpenAI's Codex, a safe Git command could be altered to write to arbitrary paths or execute scripts via Git's pager or hook mechanisms. OpenAI fixed the flaw and paid a bounty. The fourth pattern exploits privileged local daemons that sit outside the sandbox entirely. Unix sockets, Docker's socket, and other IPC endpoints are accessible to the agent if the sandbox does not block them. One such Docker-socket bug affected Cursor, Codex, and Gemini CLI simultaneously.
Google's response stood out. The tech giant classified both Antigravity findings as "other valid security vulnerabilities," downgraded their severity to "hard to exploit," and did not issue patches. It did, however, praise one report as "of exceptional quality." Pillar Security counters that the "hard to exploit" label downplays the risk: the bugs require a developer to trust a poisoned repository, which is exactly the everyday scenario these agents introduce. Developers routinely clone unknown repositories, install dependencies from package registries, and apply diffs from pull requests. A malicious actor can seed a popular open-source project with a poisoned README or a compromised dependency, and the agent, when invoked, will innocently write the malicious file into the project folder. The host tool then executes the file without suspicion.
The broader implication is a shift in how we think about agent security. An agent's blast radius is not the agent process itself; it is everything the agent can write that the host later trusts. As Pillar Security put it, "If an agent gets to write the future inputs of systems, it was never sandboxed in the first place." This pattern is not new—similar attacks have been seen with IDE extensions, build scripts, and CI/CD pipelines—but its breadth is unprecedented: four tools from three major vendors all share the same fundamental weakness. This revelation lands the same week OpenAI disclosed that its own model kept slipping its sandbox, part of a wider industry reckoning over AI-agent security.
For developers and organizations choosing an agentic coding tool, the useful question has changed. It is no longer whether the agent has a sandbox. It is what happens to the files it leaves behind, and who runs them next. The sandbox must be redefined to include not just the agent's runtime environment but also the trust chain of files it produces. Until tools adopt a zero-trust approach to file provenance—treating every file written by an AI agent as untrusted until validated—these escapes will remain a vector for supply-chain attacks. The research underscores that AI coding agents, while powerful, introduce a new class of security vulnerabilities that require proactive defense, not just reactive patching.