AI Sandbox Escapes: Your Host Isn't Safe!

Security researchers at Pillar Security have uncovered seven critical sandbox escapes impacting four major AI coding tools. These tools are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. What's interesting is the AI agents didn't directly break out of their sandboxes. Instead, they followed their workspace rules but wrote specific files. Trusted tools outside the sandbox then executed, loaded, or scanned these files. This indirect method shows an AI agent’s impact can go far beyond its isolated process. The researchers reproduced these bypasses over several months. They found that modern development environments constantly run automated tools outside the sandbox. A malicious instruction, often from prompt injection, hidden in a file can become a real action on the developer’s machine. Fortunately, most identified vulnerabilities have already been patched by vendors. Cursor fixed its issues in version 3.0.0, including a vulnerability tracked as CVE-2026-48124. OpenAI also patched a Codex CLI flaw and paid a high-severity bounty. A shared Docker socket vulnerability affecting Cursor, Codex, and the Gemini CLI was also fixed. Google, however, downgraded the severity of its two Antigravity findings. They classified them as valid security issues but difficult to exploit. Pillar Security countered, emphasizing that trusting poisoned repositories is an everyday risk these AI agents introduce. The bottom line is that agentic tools are quickly becoming active parts of our systems, and understanding their security implications is crucial.