AI Coding Agents Escaping Sandboxes: A Study Finds
Researchers Escape Four Top AI Coding Agents’ Sandboxes Without Breaking Them
Security researchers successfully navigated the sandboxes of four prominent AI coding tools—Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity—without compromising their integrity. Notably, the agents remained within the sandbox environment while executing actions that led to escaping. Three vendors have already patched the vulnerabilities. Google, however, downgraded the severity of the issues and chose not to patch them, despite acknowledging one report as "of exceptional quality."
The Escape Mechanism
The researchers utilized prompt injection techniques to exploit these sandboxes. By injecting malicious instructions into seemingly harmless files within the sandboxed environment, they were able to execute commands on their host systems. This happens because tools outside the sandbox trust and read the files generated by the agents inside. Extensions, Git integrations, and Docker Desktop are examples of how a file written by an agent can become a command executed later.
The Vulnerabilities
Pillar Security identified seven distinct vulnerabilities categorized into four main failure patterns:
- Denylists That Cannot Keep Pace: These fail to restrict access to system commands.
- Workspace Config as Code: Sensitive configurations are treated as code, accessible to malicious actors.
- "Safe" Command Lists Trusting Name Over Arguments: This allows for command injection vulnerabilities.
- Privileged Local Daemons Outside the Box: These run with elevated privileges and can be exploited.
Fixes and Response from Vendors
The majority of the identified issues have been patched. Cursor addressed a critical vulnerability (CVE-2026-48124) in version 3.0.0. OpenAI fixed a Codex flaw, and one Docker-socket bug affected all three tools: Cursor, Codex, and Gemini CLI.
Google’s response stood out, classifying the Antigravity findings as "other valid security vulnerabilities" and downgrading their exploitability. Despite this, they acknowledged one report as exceptional. Pillar counters that even if these bugs are less exploitable, they introduce a daily risk to developers who trust poisoned repositories.
A Shifting Perspective on AI Agent Security
The key takeaway is a shift in perspective regarding AI agent security. The potential blast radius of an agent extends beyond its process; it encompasses everything the agent can write that might later be trusted and executed by host systems. This means the question for users considering AI coding tools is no longer about whether the agent has a sandbox but what happens to the files it generates and who runs them afterward.