The Week of Sandbox Escapes: 7 Vulnerabilities in Four AI Coding Assistants

Pillar Security has published a series of write-ups under the title “The Week of Sandbox Escapes”: one analysis a day, each showing a different route across the isolation boundary. Over the course of several months the researchers found and reproduced seven ways to bypass the protections in four popular AI coding assistants — Cursor, Codex, Gemini CLI and Antigravity.

The key takeaway: an agent almost never needs to break the sandbox directly. It's enough to write something that a trusted component outside the sandbox will later run, load or deem safe. In other words, an agent's blast radius is not just its own process, but everything it can write to and that the host subsequently trusts.

Four recurring scenarios

The findings fall into four typical failures.

Blocklists lose to the complexity of the OS. The macOS Seatbelt profile in Antigravity operated on an “allow by default” basis and was obliged to remember every dangerous capability the system had. As the authors put it, this isn't a sandbox but a list of things someone remembered to block — and it's always one line shorter than it needs to be.

Project configuration is code. The agent would write files it was allowed to write, and the escape happened later, when the host treated them as trusted configuration. That's how it worked with a task in .vscode that Antigravity then ran itself, a hook config in .claude, a swapped-out virtual-environment interpreter that Cursor's Python extension reached for, and a Git-metadata trick that triggered execution through fsmonitor.

“Safe” commands aren't safe by name. Codex's allowlist trusted the git show command because the name looked like a read. But Git has a wealth of flags that change its behavior: the command can write files, load config, invoke helpers and trigger hooks. The question isn't “is git show safe,” but which exact invocation is run, with which arguments, and in which directory.

Local daemons live outside the box. The Docker socket finding is a reminder: isolating the agent's process doesn't isolate the host. A privileged daemon is a second execution environment, and if the agent can reach it, it does through the daemon's hands what it's forbidden to do itself.

The vendors' response

Some of the problems have already been closed. The Docker socket vulnerability has been fixed (GHSA-v4xv-rqh3-w9mc), the venv, fsmonitor and hook-config issues were addressed in Cursor (the last of these was assigned CVE-2026-48124), and the hole in Codex's allowlist was patched in version 0.95.0 with a bounty paid out. Google, however, classified both Antigravity findings as “normal application behavior” and lowered their priority, judging exploitation to be difficult — while calling the reports “exceptionally high quality.”

The researchers' central message is addressed to those who purchase such tools: it isn't enough to ask “is there a sandbox.” You need to understand what the agent can write, which host components trust those writes, which daemons it can reach, and which commands go through without confirmation. Agentic tools became infrastructure before anyone started governing them as infrastructure — and that, in Pillar's view, calls for a threat model of its own.

Source: Lobsters