Researchers escaped four top AI coding agents’ sandboxes without ever breaking them

The tools are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. Over several months, Pillar Security found ways for each agent to cross its security boundary while staying, technically, inside the box.

The escape that isn’t one

The trick is neat. These sandboxes trust the agent inside the project folder and protect the host outside. But the files in that folder are not inert.

Tools running outside the sandbox read them. A Python extension resolves an interpreter, a Git integration scans a repo, Docker Desktop exposes a local socket. So a file the agent is allowed to write can become a command the host later runs, as BleepingComputer explains.

The trigger is prompt injection. A malicious instruction hidden in a README, an issue, a dependency, or a diff turns into a real action on the developer’s machine.

Seven bugs, four patterns

Pillar sorts seven findings into four failure modes: denylists that cannot keep pace with the operating system, workspace config that is really code, “safe” command lists that trust a name over its arguments, and privileged local daemons that sit outside the box entirely.

The fixes are mostly in. In Cursor, a workspace hook config that ran unsandboxed commands is now CVE-2026-48124, patched in version 3.0.0. OpenAI fixed a Codex flaw where a “safe” Git command was not, and paid a bounty. One Docker-socket bug hit Cursor, Codex, and Gemini CLI at once.

Google shrugged

Google’s response stood out. It classified both Antigravity findings as “other valid security vulnerabilities,” downgraded their severity as hard to exploit, and did not patch, Neowin reported. It did, however, call one report “of exceptional quality.”

Pillar’s counter is that “hard to exploit” is doing a lot of work. The bugs need a developer to trust a poisoned repository, which is exactly the everyday risk these agents introduce.

Agents are the new endpoint

The bigger point is a shift in thinking. An agent’s blast radius, Pillar argues, is not the agent process. It is everything the agent can write that the host later trusts.

“If an agent gets to write the future inputs of systems, it was never sandboxed in the first place,” the team wrote. The pattern is not new, but its breadth is: four tools, three vendors. It lands the same week OpenAI revealed its own model kept slipping its sandbox, part of a wider reckoning over AI-agent security.

What to ask now

For anyone choosing an agentic coding tool, the useful question has changed. It is no longer whether the agent has a sandbox. It is what happens to the files it leaves behind, and who runs them next.