Popular AI Coding Tools Vulnerable to Sandbox Escape Attacks
Security researchers at Pillar Security uncover serious sandbox escape vulnerabilities in four major AI coding agents: Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity. Rather than attacking the sandboxes directly, the researchers exploit a subtle trust gap. The AI agent stays safely inside its sandbox and follows every rule, but it writes files that external tools outside the box later read, run, or scan. This turns seemingly inert workspace files into vectors for executing commands on the developer's machine.
The attack triggers through prompt injection, where a malicious instruction hides in a README, an issue ticket, a dependency, or a code diff. External tools constantly interact with workspace files — Python extensions resolve interpreters, Git integrations scan repositories, and hook engines fire commands. When these trusted tools encounter the agent's crafted files, the escape happens automatically. Pillar Security categorizes the seven findings into four failure modes: weak denylist sandboxes, workspace configs that act as executable code, command allowlists that trust names over arguments, and privileged local daemons operating outside the sandbox entirely.
Most of the discovered vulnerabilities now have patches and vendor acknowledgment. Cursor addresses a hook config execution flaw tracked as CVE-2026-48124 in version 3.0.0, along with additional bugs involving virtualenv interpreters and Git metadata manipulation. The findings highlight a growing challenge as AI coding tools gain popularity: sandboxes protect against direct attacks but struggle with indirect threats flowing through the files they produce. Developers using these tools need to stay current with patches and remain cautious about untrusted code entering their workspaces.