Security firm Pillar Security has published a series of findings demonstrating that four widely used AI coding agents — Cursor, OpenAI's Codex CLI, Google's Gemini CLI and Google's Antigravity — can escape the sandboxes meant to contain them, exposing a broader attack surface than developers commonly assume.
The Week of Sandbox Escapes · Security Research
Four AI Coding Agents Can Escape Their Own Sandboxes
Cursor, OpenAI's Codex CLI, Google's Gemini CLI and Antigravity were shown to reach the host machine — not by breaking the sandbox, but by writing files that trusted host tooling later loads and executes.
4
AI coding agents confirmed to escape their sandbox
7
Distinct boundary failures, one detailed report per day
9.8
CVSS score of an earlier Cursor path-handling flaw (CVE-2026-50548)
The Core Idea
"Workspace config equals executable infrastructure"
Agent writes
Files inside the workspace it's allowed to modify
→
Host tooling trusts
tasks.json, .git/hooks, venv, Docker socket auto-loaded
→
Host executes
Code crosses the security boundary onto the machine
Proof-of-Concept Chains
One reachable file becomes full host access
Docker socket
Privileged container + VirtioFS writes into ~/.zshrc — Codex, Cursor, Gemini
virtualenv interpreter
Tampering in Cursor
.git + fsmonitor
Directory-name spoofing in Cursor
.claude hooks
Abuse tracked as CVE-2026-48124
VSCode tasks.json
Task configuration manipulation in Antigravity
Security View
The real blast radius of a compromised agent is wider than assumed. Even a sandboxed agent can reach the host — pointing toward the need for kernel-level boundaries rather than policy-based restrictions alone.
Vendor View
Responses varied: some issues fixed (Cursor patched several in v3.0), others marked informational or configuration-dependent — reflecting disagreement over what is expected behavior versus a genuine vulnerability.
The structural challenge: as agents gain autonomy to write files and run commands, indirect prompt injection — via a README or an external service response — could turn a subtle workspace write into full host access. Reconciling productivity with boundary-aware isolation is set to define the agentic-coding category.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…