Security researchers at Pillar Security spent the back half of July publishing “The Week of Sandbox Escapes,” a daily write-up series documenting sandbox breakouts and boundary bypasses across four of the most widely deployed AI coding agents: Cursor, OpenAI’s Codex CLI, Google’s Gemini CLI, and Google Antigravity. The pattern across almost every finding was the same: the agent itself never broke out of its sandbox directly. Instead, it wrote something that a trusted component sitting outside the sandbox later ran, loaded, or trusted as safe — turning a permitted file write into effectively unsandboxed code execution.
The clearest example hit three tools at once. Codex CLI, Cursor, and Gemini CLI all shared exposure to a local Docker socket that a privileged daemon left reachable outside the sandbox boundary, giving an agent a path to unsandboxed execution through a component nobody had thought to isolate. Pillar’s researchers grouped the underlying causes into four repeatable failure modes: denylist-based sandboxes that can’t keep pace with OS-level complexity, workspace configuration files that are effectively executable code in disguise, “safe command” allowlists that trust a command’s name rather than its full invocation, and privileged local daemons sitting entirely outside the sandbox’s reach. Cursor’s specific flaw — a workspace-controlled hook config that could escalate into unsandboxed command execution — was assigned CVE-2026-48124 and patched in version 3.0.0. Google classified its two Antigravity findings as lower-severity, judging them harder to exploit because they require either social engineering or a user trusting a repository carrying an indirect prompt injection.
So what
This isn’t a story about one vendor having a bad week — it’s evidence that “sandboxed” is doing a lot of unearned work as a trust signal across the entire AI coding agent category, echoing the pattern this site has tracked since GhostApproval and the Claude Code permission-bypass fixes earlier this month. If your team runs any AI coding agent — Cursor, Codex, Gemini CLI, Claude Code, or otherwise — with access to anything client-facing or production-adjacent, “it runs in a sandbox” is not sufficient due diligence on its own; patch status, daemon exposure, and workspace-config trust boundaries all matter. That’s exactly the governance and risk assessment we bring into AI-assisted development engagements — get in touch if you want your current AI coding setup reviewed before it becomes next month’s disclosure.