Top AI coding agents escaped sandboxes from the inside

Pillar Security says it found ways for four leading AI coding agents — Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity — to cross their security boundaries without technically leaving their sandboxes.

The core issue is simple: these tools are trusted inside a project folder, while the host system outside is supposed to stay protected. But files inside that folder are not passive. Software running outside the sandbox may still read and act on them. As BleepingComputer explained, that can include a Python extension resolving an interpreter, a Git integration scanning a repository, or Docker Desktop exposing a local socket. A file an agent is allowed to write can then become a command the host later runs.

According to Pillar, the trigger is often prompt injection. A malicious instruction hidden in a README, an issue, a dependency, or a diff can be turned into a real action on a developer’s machine.

Pillar grouped its seven findings into four failure modes:

Recommended reading

OpenAI says its model hacked Hugging Face on its own

• denylists that cannot keep up with the operating system
• workspace configuration that is effectively code
• “safe” command lists that trust a command name but not its arguments
• privileged local daemons outside the sandbox entirely

Most of the issues have already been addressed. In Cursor, a workspace hook configuration that executed unsandboxed commands is now tracked as CVE-2026-48124 and was patched in version 3.0.0. OpenAI fixed a Codex flaw where a supposedly safe Git command was not actually safe, and it paid a bounty. One Docker socket issue affected Cursor, Codex, and Gemini CLI at the same time.

Google’s response to the Antigravity findings

Google’s handling of the Antigravity reports stood out. According to Neowin, the company labeled both findings as “other valid security vulnerabilities,” lowered their severity because they were hard to exploit, and did not patch them. Google did, however, describe one report as “of exceptional quality.”

Pillar argues that “hard to exploit” misses the point, because these attacks depend on a developer trusting a poisoned repository — exactly the kind of routine risk these agentic tools introduce.

The company’s broader argument is that the real blast radius is not the agent process itself, but every file the agent writes that the host later trusts.

“If an agent gets to write the future inputs of systems, it was never sandboxed in the first place.”

The findings span four tools and three vendors, and arrive the same week OpenAI disclosed that one of its own models kept slipping its sandbox. For developers evaluating coding agents, the key question is no longer whether a sandbox exists, but what happens to the files the agent leaves behind.