Security Researchers Uncover Sandbox Escapes in Leading AI Coding Assistants, Exposing Potential Vulnerabilities

Security researchers have successfully bypassed the sandboxed environments of four prominent AI coding agents, including Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. The novel attack vector, detailed in a series of reports dubbed "The Week of Sandbox Escapes" by Pillar Security, circumvents traditional head-on assaults by leveraging the trusted interactions between the AI agent and external tools. Instead of directly breaching the sandbox’s perimeter, the researchers exploited the AI’s ability to write files that are subsequently processed and executed by trusted, unsandboxed host tools, effectively turning benign file creation into a command execution pathway.

This sophisticated method challenges the fundamental security assumption underpinning these AI coding assistants: that the agent operates in a strictly isolated environment, unable to directly influence the host system, while the host system remains protected. The research team, comprising Eilon Cohen, Dan Lisichkin, and Ariel Fogel from Pillar Security, spent several months meticulously reproducing and documenting these bypasses, releasing their findings on a daily basis since today. Their work illuminates a critical blind spot in the security architecture of tools designed to enhance developer productivity.

The core of the exploit lies in the inherent trust placed in files generated within the AI agent’s workspace. While the agent itself adheres to sandbox rules, the output of its operations – the files it creates – are not treated as inert data. Instead, they become inputs for various tools that operate outside the sandbox, such as Integrated Development Environments (IDEs) and Command Line Interface (CLI) agents. These external tools, essential for the AI’s functionality, are designed to read, interpret, and act upon files within the project directory. Consequently, a file that the AI agent is permitted to write can be ingeniously crafted to contain malicious commands that these trusted external tools will inadvertently execute on the developer’s machine.

This dynamic is exemplified by the common practice of IDEs and CLI agents running their own supporting tools. For instance, Python extensions might resolve interpreters, Git integrations might scan repositories for changes, VS Code could execute task files, hook engines might fire off commands, and even Docker Desktop can expose local sockets that these tools interact with. A sandboxed agent, by all appearances, remains within its designated boundaries. However, by subtly manipulating the content of files that these external, trusted components will inevitably process, the agent can indirectly influence the host system’s behavior.

The trigger for these "sandbox escapes" is often prompt injection. This occurs when a malicious instruction is subtly embedded within seemingly innocuous content, such as a README file, a bug report, a dependency declaration, or even a code diff. When the AI agent processes this injected prompt, it can generate output that, when interpreted by an external tool, results in unauthorized local actions on the developer’s workstation. Pillar Security has categorized their seven distinct findings into four fundamental failure modes, highlighting the diverse pathways through which these bypasses can be achieved.

Chronology of Discovery and Mitigation

The research from Pillar Security builds upon a growing awareness of security challenges in the rapid adoption of AI-powered development tools. While the specific vulnerabilities were uncovered over several months by Pillar, the broader category of "Configuration-Based Sandbox Escape" was previously documented by Cymulate in April, affecting similar AI coding assistants like Claude Code, Gemini CLI, and Codex CLI. Cymulate’s research also identified a pattern where files written within the sandbox could be executed on the host system upon the next launch.

Pillar Security’s recent disclosures have provided a more granular and extensive view of this threat landscape, impacting a wider array of leading tools. The timeline of their findings and the subsequent vendor responses is as follows:

• Over several months prior to publication: Pillar Security’s research team meticulously identifies, reproduces, and documents seven distinct sandbox escape vulnerabilities across four AI coding agents.
• Today (publication date): Pillar Security launches "The Week of Sandbox Escapes," releasing daily blog posts detailing each vulnerability.
• Concurrent with discovery: As vulnerabilities are identified and verified, Pillar Security engages with the affected vendors to report their findings.
• Vendor Responses:
  • Cursor: Three vulnerabilities were reported and addressed. A .claude hook configuration leading to unsandboxed command execution was patched and is now tracked as CVE-2026-48124, fixed in version 3.0.0. A second issue involved an agent editing a virtualenv interpreter, which the editor’s Python extension then executed. A third exploit leveraged Git metadata to bypass path-based rules via fsmonitor, patched in 3.0.0 with a pending CVE.
  • OpenAI (Codex CLI): A vulnerability where a "safe" command allowlist trusted git show by name, but the actual invocation was not read-only, was patched in v0.95.0. OpenAI acknowledged the high severity and awarded a bounty, with a pending CVE.
  • Gemini CLI (Google): Affected by the Docker socket issue alongside Codex and Cursor.
  • Antigravity (Google): Two findings, including a macOS Seatbelt denylist bypass and a .vscode task-config bypass of Secure Mode. Google classified these as "Other valid security vulnerabilities" and downgraded their severity, citing the need for social engineering or user trust in a malicious repository. However, Google’s internal assessment recognized the quality of the reports.
  • Docker Socket Issue: A shared vulnerability affecting Codex, Cursor, and Gemini CLI, where a privileged local daemon accessible by the agents became a conduit for unsandboxed code execution. This issue has since been fixed.

The Technical Nuances of the Escapes

Pillar Security’s research meticulously details how these escapes are achieved by exploiting the interplay between the AI agent’s file-writing capabilities and the host system’s automatic execution of certain file types or configurations. The fundamental principle is that while the AI agent is confined, the files it generates are not. These files can be interpreted as instructions by other, trusted components of the development environment.

• Workspace Control and Hook Configurations: In Cursor, a vulnerability was identified where a .claude hook configuration, which is part of the workspace’s settings, could be manipulated by the AI agent. This configuration, when processed by Cursor’s internal mechanisms, resulted in the execution of commands outside the intended sandbox. This highlights how configuration files, often seen as administrative elements, can become vectors for attack if not properly sanitized.
• Interpreter Manipulation: Another Cursor vulnerability exploited the way the IDE’s Python extension handles virtual environment interpreters. The AI agent was able to modify the interpreter file itself. When the Python extension later initiated a discovery process, it would inadvertently execute code from the tampered interpreter, leading to unsandboxed execution. This underscores the sensitivity of environment-specific configuration files.
• Git Metadata Abuse: The third Cursor exploit demonstrated a sophisticated understanding of Git’s internal workings. Git metadata is not strictly confined to a .git directory. By strategically placing or modifying files that Git’s fsmonitor feature would process, the AI agent could trigger command execution. fsmonitor is designed for performance by efficiently tracking file changes, and when manipulated, it can be coerced into running arbitrary commands. This bypasses path-based security rules that might only monitor specific directories.
• Command Allowlist Loopholes: For OpenAI’s Codex CLI, the issue lay in a seemingly secure command allowlist. While the allowlist permitted commands like git show by name, it did not sufficiently validate the arguments or the full execution context. The AI agent could craft a command that, while appearing to be git show, was actually executed in a way that allowed for unintended side effects or data exfiltration, effectively bypassing read-only restrictions.
• Docker Socket Exploitation: The shared vulnerability impacting Codex, Cursor, and Gemini CLI involved the Docker daemon’s local socket. This socket provides an interface for interacting with the Docker engine. If an AI agent can write to a location that the external tooling uses to communicate with this socket, it can issue commands to the Docker daemon, effectively running code on the host system with elevated privileges, bypassing sandbox restrictions entirely.

Google’s Response and Industry Perception

Google’s reaction to the two Antigravity findings presented a nuanced perspective on vulnerability assessment. The company classified the macOS Seatbelt denylist bypass and the .vscode task-config bypass of its Secure Mode as "Other valid security vulnerabilities." This classification, while acknowledging the existence of a flaw, indicated a lower perceived risk by Google. The company’s rationale was that exploiting these vulnerabilities would likely require a significant degree of social engineering or a user’s explicit trust in a malicious repository that contained the indirect prompt injection.

This approach suggests a risk model that prioritizes vulnerabilities requiring active user complicity or deception over those that can be exploited passively. However, Pillar Security emphasized that even with these classifications, Google’s internal teams recognized the merit of their research, with one report receiving feedback described as "of exceptional quality." This highlights a potential disconnect between a vendor’s public-facing risk assessment and their internal technical evaluation of security findings.

Broader Implications and Future Security Paradigms

The breadth of these findings across four major AI coding agents from three different vendors is a significant signal for the industry. It indicates that the problem of sandbox escapes in AI-powered development tools is not an isolated incident but a systemic challenge. As developers increasingly rely on these agents to accelerate their workflows, the potential for these vulnerabilities to be exploited in real-world scenarios grows.

The implications are far-reaching:

• Developer Workstation Security: A compromised AI agent could lead to the installation of malware, data theft, or unauthorized access to sensitive code repositories and intellectual property residing on a developer’s machine.
• Supply Chain Risks: If an AI agent is integrated into a company’s development pipeline, a sandbox escape could potentially compromise the entire software supply chain, affecting multiple projects and users.
• Trust in AI Tools: These findings can erode developer trust in AI coding assistants, potentially slowing down their adoption despite their productivity benefits.
• Vendor Responsibility: Vendors of AI coding tools face increased pressure to implement more robust security measures, including stricter input validation, enhanced sandboxing techniques, and continuous security auditing.

Pillar Security’s proposed solution moves beyond simply blacklisting specific filenames. Their focus is on monitoring the execution context: specifically, identifying when a trusted local tool processes data generated by an AI agent. This suggests a shift towards a more dynamic and context-aware security monitoring approach, where the behavior of trusted tools in response to AI-generated content becomes the primary security metric.

The "Week of Sandbox Escapes" serves as a critical wake-up call for the cybersecurity community and the developers of AI-powered tools. It underscores the need for a proactive and layered security strategy that anticipates novel attack vectors and continuously re-evaluates the security assumptions of emerging technologies. As AI becomes more deeply integrated into critical workflows, ensuring the security of these powerful tools is paramount to maintaining the integrity and safety of the digital ecosystem. The industry must now grapple with developing more resilient sandboxing mechanisms and robust monitoring systems that can adapt to the evolving capabilities of AI agents and the ingenuity of security researchers and potential attackers alike.