Researchers escaped four top AI coding agents’ sandboxes without ever breaking them

Pillar Security found that four top AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity — can be made to cross their security boundaries via prompt injection, without technically breaking the sandbox. The researchers identified seven bugs across four failure modes, including denylists that cannot keep pace with the OS, workspace config that is really code, trusted command names that ignore arguments, and privileged local daemons outside the box. Cursor patched its flaw (CVE-2026-48124) in version 3.0.0, OpenAI fixed a Codex bug and paid a bounty, but Google classified both Antigravity findings as hard to exploit and did not patch.

The tools are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. Over several months, Pillar Security https://www.pillar.security/blog/the-week-of-sandbox-escapes found ways for each agent to cross its security boundary while staying, technically, inside the box. The escape that isn’t one The trick is neat. These sandboxes trust the agent inside the project folder and protect the host outside. But the files in that folder are not inert. Tools running outside the sandbox read them. A Python extension resolves an interpreter, a Git integration scans a repo, Docker Desktop exposes a local socket. So a file the agent is allowed to write can become a command the host later runs, as BleepingComputer https://www.bleepingcomputer.com/news/security/cursor-codex-gemini-cli-antigravity-hit-by-sandbox-escapes/ explains. The trigger is prompt injection https://thenextweb.com/news/claude-code-github-action-prompt-injection-flaw . A malicious instruction hidden in a README, an issue, a dependency, or a diff turns into a real action on the developer’s machine. Seven bugs, four patterns Pillar sorts seven findings into four failure modes: denylists that cannot keep pace with the operating system, workspace config that is really code, “safe” command lists that trust a name over its arguments, and privileged local daemons that sit outside the box entirely. The fixes are mostly in. In Cursor https://thenextweb.com/news/spacex-cursor-60-billion-acquisition , a workspace hook config that ran unsandboxed commands is now CVE-2026-48124, patched in version 3.0.0. OpenAI https://thenextweb.com/news/gpt-red-openai-ai-hacker fixed a Codex flaw where a “safe” Git command was not, and paid a bounty. One Docker-socket bug hit Cursor, Codex, and Gemini CLI at once. Google shrugged Google’s response stood out. It classified both Antigravity findings as “other valid security vulnerabilities,” downgraded their severity as hard to exploit, and did not patch, Neowin https://www.neowin.net/news/pillar-research-shows-sandboxes-are-inadequate-for-agentic-ai-google-decides-not-to-patch/ reported. It did, however, call one report “of exceptional quality.” Pillar’s counter is that “hard to exploit” is doing a lot of work. The bugs need a developer to trust a poisoned repository, which is exactly the everyday risk these agents introduce. Agents are the new endpoint The bigger point is a shift in thinking. An agent’s blast radius, Pillar argues, is not the agent process. It is everything the agent can write that the host later trusts. “If an agent gets to write the future inputs of systems, it was never sandboxed in the first place,” the team wrote. The pattern is not new, but its breadth is: four tools, three vendors. It lands the same week OpenAI revealed its own model kept slipping its sandbox https://thenextweb.com/news/openai-long-horizon-model-sandbox-escape-paused , part of a wider reckoning over AI-agent security https://thenextweb.com/news/ai-agent-security-four-attacks-one-flaw . What to ask now For anyone choosing an agentic coding tool, the useful question has changed. It is no longer whether the agent has a sandbox. It is what happens to the files it leaves behind, and who runs them next. Get the TNW newsletter Get the most important tech news in your inbox each week.