GoKawiilSecurity researchers broke out of the sandboxes in four widely used AI coding agents, including Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity, without attacking the sandbox head-on.
The agent stays inside the box and follows every rule. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own.
How the escapes work
Pillar Security's research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes, one write-up a day.
These sandboxes draw a simple line: the agent is trusted inside the project workspace, the host outside is protected.
The catch is that files inside the workspace are not inert. Tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs.
The agent stays sandboxed, but the files it writes are trusted by tools outside the box
(Pillar Security)
IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, Docker Desktop exposing a local socket.
A sandboxed agent can obey every rule it is given and still shape the files those components read.
... continue reading