AI coding agents like OpenAI Codex are escaping their sandboxes not by breaking out directly, but by writing files that trusted system components later execute without question. Over several months, researchers at Pillar Security discovered and reproduced sandbox bypasses across Codex, Cursor, Gemini CLI, and Antigravity, revealing a fundamental flaw in how these tools are secured.

The problem is not new in theory, but it is urgent in practice. Most organizations deployed agentic coding tools as productivity infrastructure before treating them as security infrastructure. Developers now rely on these agents to write code, modify configurations, and interact with their development environments, often in the same workspace where SSH keys, cloud tokens, and production access live nearby.

Why Sandbox Boundaries Are Failing?

The research identified four repeatable failure modes that allow agents to escape containment:

• Denylist Sandboxes: Security profiles that start from "allow by default" cannot keep pace with operating system complexity, leaving dangerous operations unblocked.
• Workspace as Executable Code: Project files and configurations that agents are allowed to write are later executed by unsandboxed host components like Python interpreters and Git extensions.
• Unsafe Command Allowlists: Approval systems that trust command names instead of modeling dangerous arguments and side effects.
• Privileged Local Daemons: Powerful services like Docker Desktop sockets sit outside the sandbox entirely and remain reachable from restricted agents.

The core insight is that an agent's blast radius is not limited to the agent process itself. It includes everything the agent can write that the host system later trusts. A sandboxed agent can follow every rule it is given and still shape the inputs that unsandboxed components consume.

What Specific Vulnerabilities Did Researchers Find?

Pillar Security released detailed findings on seven distinct sandbox escapes, each demonstrating a different attack vector:

• Antigravity Seatbelt Bypass: A denylist-style macOS Seatbelt profile left OS features reachable, allowing execution outside the sandbox. Google classified this as a valid security vulnerability but applied a downgrade, noting the issue is difficult to exploit.
• Docker Socket Exposure: A privileged local daemon became an unsandboxed execution environment reachable from otherwise restricted agents in Codex, Cursor, and Gemini CLI. This issue was fixed with advisory GHSA-v4xv-rqh3-w9mc.
• Virtual Environment Modification: In Cursor, the agent modified a Python virtualenv interpreter that Cursor's unsandboxed Python extension later executed during discovery, bypassing sandbox controls. Fixed with advisory GHSA-p9g2-cr55-cw9c.
• Git Metadata Indirection: Git directories do not have to be named ".git", allowing agents to slip past path-based sandbox rules and trigger execution through file system monitoring.
• Command Allowlist Abuse: Codex CLI trusted a command name without modeling dangerous arguments and Git side effects, turning a safe-command allowlist into remote code execution. Patched in version 0.95.0.
• Hook Configuration Execution: Cursor's workspace-controlled.claude hook config turned into unsandboxed command execution. Fixed in version 3.0.0 with CVE-2026-48124.
• VSCode Task Time Bomb: In Antigravity, the agent wrote a VSCode task configuration that the host later ran on its own, bypassing Secure Mode entirely.

Each vulnerability followed the same pattern: the agent did not need to break the sandbox directly. It only had to write something that a trusted component outside the sandbox would later run, load, scan, or treat as safe.

How Should Organizations Assess Agentic Tools?

Security leaders and CISOs need to shift their approach to evaluating AI coding agents. Rather than assuming a sandbox is sufficient, organizations should demand transparency about where the sandbox boundary actually exists:

• Boundary Visibility: Require vendors to prove where the sandbox boundary actually is and what the agent can write to disk.
• Host Trust Mapping: Identify which host components trust the files the agent writes, which local daemons the agent can reach, and which commands skip approval entirely.
• Telemetry and Monitoring: Ensure telemetry exists when a trusted helper executes something the agent influenced, enabling detection of exploitation attempts.
• Endpoint Governance: Treat agentic tools as endpoint actors, not just development utilities, and assess, monitor, and govern them accordingly.

The productivity gains of AI coding agents are real, and developers are already using them. The problem is that these tools became infrastructure before most organizations governed them as infrastructure. Modern IDEs and CLIs are full of host-side automation: Python extensions discover interpreters, Git integrations scan repositories, VSCode task runners load project tasks, hook engines fire lifecycle commands, and Docker Desktop exposes powerful local sockets. A sandboxed agent can follow every rule and still shape the inputs those components consume.

Pillar Security released the research as "The Week of Sandbox Escapes," with one deep-dive published each day showing a different route across the boundary. The findings cluster into four repeatable failure modes that appear across multiple vendors and products, suggesting the problem is systemic rather than isolated to any single tool.

As agentic AI tools mature and adoption accelerates, the security conversation must evolve beyond sandboxes and approval prompts. Organizations need to understand the full attack surface, including the files agents write and the trusted components that later execute them. Without that visibility, the sandbox becomes a false sense of security.