Researchers Uncover Sandbox Escape Bugs in Four AI Coding Agents

Three security researchers from the Israeli firm Pillar Security have published a series of eight vulnerabilities that allow sandbox escapes in four of the most popular AI coding agents: Cursor, OpenAI's Codex CLI, Google's Gemini CLI, and Antigravity. The shared attack mechanism is surprisingly simple: the agent never formally breaks a rule, it just writes a file that some other tool, already operating outside the sandbox, ends up trusting.

How the escape works

Modern coding agents run inside sandboxes that restrict their access to the file system and network. The problem is that files an agent writes inside the sandbox are often later read, loaded, or executed by trusted tools operating outside it, editor extensions, package managers, local daemons. The agent itself never formally crosses the boundary; the system that trusted it does.

An agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts - Pillar Security

Four tools, eight vulnerabilities

In Cursor, the researchers found three independent attack paths: a .claude hooks configuration file controlled by workspace content allowed commands to run outside the sandbox (CVE-2026-48124, patched in version 3.0.0), a modified virtualenv interpreter was later executed by Python extensions, and manipulating Git metadata via fsmonitor bypassed path-based security rules.

In OpenAI's Codex CLI, the issue was the allowlist of permitted commands: the git show command looked like a read-only operation but wasn't, which allowed the allowlist to be bypassed (GHSA-v4xv-rqh3-w9mc, patched in version 0.95.0). In Google's Gemini CLI, the flaw involved access to the Docker socket, while in Antigravity it involved bypassing macOS Seatbelt's blocklist and .vscode task configuration.

A shared Docker socket flaw

The most serious of the vulnerabilities found affected three tools at once: Codex, Cursor, and Gemini CLI. All three agents had access to the Docker socket, a local, privileged daemon that effectively became a second, uncontrolled runtime environment outside the sandbox's boundaries. All it took was the agent issuing the right command to the daemon for code to execute with no restrictions at all.

In practice, the initial attack vector is often a prompt injection hidden in a README file, a GitHub issue, or a project dependency, content the agent reads as part of its work that contains hidden instructions leading it to write a malicious file later exploited by a trusted tool.

Vendor responses

Most of the reported bugs have since been patched. OpenAI paid a substantial bug bounty for one of the reports. Google rated the research highly while downgrading the severity of two Antigravity vulnerabilities, arguing that exploiting them requires social engineering or a user trusting a repository that contains a hidden prompt injection instruction.

If an agent gets to write the future inputs of systems, it was never sandboxed in the first place - Pillar Security

The researchers stress that the problem is structural rather than a one-off flaw: every additional integration between an agent and an external tool, editor, or system daemon potentially opens a new escape path, regardless of how airtight the agent process's own sandbox is.

What it means for developers

Cursor, Codex CLI, Gemini CLI, and Antigravity are among the most widely installed AI coding agents in the world, also used by Polish developers for day-to-day repository work. Pillar Security's findings show that a process-level sandbox alone doesn't protect a developer's machine if the agent has access to tools the system trusts unconditionally, from editor extensions to local daemons like Docker.

For teams rolling out agentic tools inside companies, this means every integration between an agent and an external system needs to be treated as its own attack surface, rather than relying solely on the vendor's stated sandbox restrictions.