Security researchers have uncovered a method to breach the sandbox environment using four popular AI coding agents, including Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity, without direct attacks.
These agents operate within the sandbox confines and adhere to all established rules. By simply creating a file, your trusted tools can execute, load, or scan it, enabling an automatic escape.
Understanding the Escape Mechanism
Pillar Security’s team, featuring experts Eilon Cohen, Dan Lisichkin, and Ariel Fogel, dedicated months to reconstructing the bypass technique, culminating in the findings shared during Sandbox Escape Week.
These sandboxes maintain clearly defined boundaries, granting the agent trust within the project workspace while safeguarding external hosts.
However, the files within the workspace are active, meaning tools operating outside the sandbox can interact with them. Consequently, the files written by the agent can evolve into commands executed by the host system.
(Pillar Security)
IDE and CLI agents commonly run tools outside the sandbox. These include Python extensions for interpreter resolution, Git integrations for repository scans, and Docker Desktop for local socket exposure.
The sandbox agent adheres to all prescribed rules while shaping the files read by various components.
Immediate injection serves as the trigger. Malicious instructions embedded within READMEs, issues, dependencies, or diffs lead to local actions on the developer’s machine.
Pillar has categorized the seven findings into four main failure modes:
- Denylist sandboxes incompatible with the operating system
- Workspace configurations that function as executable code
- Authorization lists that mistakenly trust names over command arguments
- A privileged local daemon operating completely outside the sandbox
Identified Bugs and Solutions
The majority of the issues have been resolved, and vendors are aware of the exploits.
Cursor has replaced workspace-controlled .claude hook configurations with non-sandboxed command execution, now identified as CVE-2026-48124 and fixed in version 3.0.0.
A second Cursor bug allowed the agent to modify the virtualenv interpreter, enabling its Python extension to run during discovery.
Additionally, exploiting Git metadata that does not need to be in a .git folder to trigger execution via fsmonitor has also been patched in version 3.0.0, with a CVE pending.
In the Codex CLI, a “secure” command mistakenly allowed a trusted git show by name while the actual call was not purely read-only. OpenAI has patched this vulnerability in version 0.95.0 and issued a high severity bounty, with a CVE pending.
Detecting a single Docker socket impacted Codex, Cursor, and Gemini CLI directly. A privileged local daemon accessible to the agent is now a non-sandboxed environment for code execution. This issue has been resolved.
Google’s Downgrade of Vulnerabilities
Google’s response to two of Antigravity’s findings, including bypassing the macOS seatbelt deny list and secure mode .vscode task settings, was notably tepid.
Pillar Security classified these findings as “other valid security vulnerabilities” but downgraded them, asserting that they would be difficult to exploit since they require user trust in repositories, often involving social engineering or indirect prompt injection.
Nonetheless, Pillar acknowledges the quality of Google’s work, noting the positive feedback on one of the reports.
Long-Standing Issues, Broad Implications
These underlying classes of vulnerabilities are not new. In April, Cymulate documented a similar pattern termed “Configuration-Based Sandbox Escape,” prevalent in Claude Code, Gemini CLI, and Codex CLI, where files created in the sandbox are executed on the host during the next boot.
What sets this apart is the extent of the vulnerabilities. The same issues affect four tools across three vendors, providing a crucial signal for evaluating coding agent tools.
Pillar’s solution is not merely a list of prohibited file names; instead, a trusted local tool monitors the moment the agent executes its written commands.
Security teams document 54% of successful attacks while issuing warnings on only 14%. The remainder moves undetected within the environment.
Picus’ whitepaper outlines how to test your SIEM and EDR rules through breach and attack simulations, ensuring threats do not go unnoticed.
Source: www.bleepingcomputer.com