Clarification · October 12, 2026
The findings used several escape routes. Many involved trusted tools executing agent-written files, but the series also included a direct sandbox-policy bypass and access to a privileged local Docker service.

What happened

Security researchers at Pillar Security spent months breaking out of the safety sandboxes built into four AI coding agents: Cursor, OpenAI’s Codex CLI, Google’s Gemini CLI, and Antigravity, Google’s agentic coding IDE. They published the results on July 20, 2026, as a series called the Week of Sandbox Escapes, one write-up a day.

A sandbox restricts the files, commands, and services an agent can access. Its configured boundary is meant to protect resources outside the allowed scope, such as login keys or Docker settings. Pillar’s team, Eilon Cohen, Dan Lisichkin, and Ariel Fogel, found seven ways an agent could still reach outside that wall, spread across all four tools.

Why it matters

Several findings exploited indirect routes. The agent wrote a file within its allowed workspace, then a trusted tool outside the sandbox loaded or executed it. Other findings involved a sandbox-policy bypass, unsafe command arguments, or access to a privileged local service.

Pillar summarizes the pattern this way: if an agent can write the future input of another system, that system was never really sandboxed. IDEs and CLI agents constantly hand off to tools running outside the sandbox: a Python extension resolving which interpreter to use, a Git integration scanning repository metadata, VS Code running a task file, a hook engine firing a command, Docker Desktop exposing a local socket. A sandboxed agent can still shape any of those inputs.

Here is what Pillar found and where each stands:

  • Cursor: a workspace .claude hook config could trigger unsandboxed command execution. Tracked as CVE-2026-48124, fixed in version 3.0.0.
  • Cursor: the agent could edit a virtualenv interpreter that the editor’s own Python extension then ran automatically during discovery. Fixed, tracked as GHSA-p9g2-cr55-cw9c.
  • Cursor: Git metadata does not have to live in a folder literally named .git, so an agent could trigger execution through fsmonitor and slip past Cursor’s path-based rules. Patched in 3.0.0, with a CVE still pending.
  • Codex CLI: a “safe” command allowlist trusted the name git show without checking that the actual invocation was read-only. OpenAI patched it in v0.95.0 and paid a high-severity bug bounty, with a CVE pending.
  • Cursor, Codex CLI, and Gemini CLI: all three could reach a local Docker socket, a privileged daemon that sits outside the sandbox, and use it to run unsandboxed code. Pillar reports the issue fixed. Check each vendor’s advisory for the applicable patched version.
  • Antigravity: a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode. Google classified both as “Other valid security vulnerabilities,” a lower severity tier, judging them harder to exploit because they need either social engineering or a user trusting a repository that carries an indirect prompt injection. Pillar says Google’s team still called one of the two reports “of exceptional quality.”

This is not the first time this class of bug has surfaced. On July 9, security firm Cymulate documented a similar pattern, which it called Configuration-Based Sandbox Escape, across three different tools: Claude Code, Gemini CLI, and Codex CLI. That was a separate report with its own set of specific bugs, but it points to the same underlying gap between “sandboxed agent” and “unsandboxed local tool” showing up across the category, not just in one product. GhostApproval’s symlink bug is another example of a trust-boundary failure.

Who should care

Anyone who runs a coding agent, IDE plugin, or CLI tool against a repository they did not write themselves should care. Prompt injection is the trigger for most of these bugs: a malicious instruction hidden in a README, an issue, a dependency, or a diff becomes a local action on your machine once a trusted tool outside the sandbox reads the file the agent wrote.

You carry more risk if you routinely open unfamiliar repositories, clone starter templates, or accept README setup instructions without reading them first, and if your machine runs Docker Desktop or another local daemon your agent can reach.

What builders should do next

Check your version against the ones Pillar and the vendors confirmed as patched:

  • Cursor: update to 3.0.0 or later. Check under Cursor’s Help/About panel, or let its built-in updater run.
  • Codex CLI: update to v0.95.0 or later. Run:
codex --version
  • Gemini CLI: Check Google’s security advisories for the Docker socket fix before assuming a recent update covers it.

Beyond version checks, treat your Docker socket and any local daemon your agent can reach as part of its trust boundary, not outside it. Keep treating unfamiliar repositories as untrusted input: a workspace config file like .vscode, .claude, or Git metadata can carry instructions that a tool outside the sandbox will later execute, even when the agent itself never leaves its box.

End of article