Four major AI coding agents, including OpenAI's Codex, can escape their security sandboxes by exploiting how they interact with files on a developer's machine, according to a new study by Pillar Security. The researchers discovered that malicious instructions hidden in project files can trick these tools into running commands outside their protected boundaries, raising questions about whether traditional sandbox protections are sufficient for agentic coding tools.

How Do These Coding Agents Break Out of Their Sandboxes?

The vulnerability hinges on a clever but concerning pattern. Sandboxes typically protect the host system while trusting files inside the project folder. However, tools running outside the sandbox read those files. A Python extension might resolve an interpreter, a Git integration might scan a repository, or Docker Desktop might expose a local socket. This means a file the agent is allowed to write can become a command the host system later runs automatically.

The attack vector is prompt injection, a technique where malicious instructions are hidden in places developers naturally trust: a README file, a GitHub issue, a dependency list, or a code diff. When the agent processes these files, the hidden instruction becomes a real action on the developer's machine.

• Denylists That Cannot Keep Pace: Security blocklists fail to account for new operating system commands and features as they evolve.
• Workspace Configuration as Code: Configuration files that should be inert data are actually executable code that runs outside the sandbox.
• Safe Command Lists That Trust Names Over Arguments: Tools whitelist commands by name alone, ignoring dangerous arguments passed to them.
• Privileged Local Daemons Outside the Box: Background services running with elevated permissions sit entirely outside the sandbox's control.

Which Tools Are Affected and How Are They Responding?

Pillar Security tested Cursor, OpenAI's Codex, Google's Gemini CLI, and Google's Antigravity. The researchers found exploitable flaws in all four tools. Most vendors have responded with patches. In Cursor, a workspace hook configuration that ran unsandboxed commands was assigned CVE-2026-48124 and patched in version 3.0.0. OpenAI fixed a Codex flaw where a Git command was incorrectly classified as safe and paid a security bounty for the discovery. A Docker socket bug affected Cursor, Codex, and Gemini CLI simultaneously.

Google's response to its Antigravity findings stood out. The company classified both vulnerabilities as "other valid security vulnerabilities" but downgraded their severity as hard to exploit and did not patch them, though it acknowledged one report as "of exceptional quality".

Why Does This Matter for Enterprise AI Governance?

The broader implication is that an agent's true blast radius is not the agent process itself, but everything the agent can write that the host system later trusts. As Pillar Security noted, "If an agent gets to write the future inputs of systems, it was never sandboxed in the first place". This shift in thinking arrives as enterprises scale AI coding agent adoption and governance platforms like Microsoft's Agent 365 expand oversight capabilities.

Microsoft's Agent 365 is extending Purview data governance audits to cover popular coding agents including GitHub Copilot Command Line Interface (CLI), Claude Code, OpenAI Codex, and OpenClaw, enabling organizations to audit activity consistently and close visibility gaps as agent use becomes more distributed. Microsoft Defender, integrated within Agent 365, is being enhanced to analyze risk exposure for local agents and can audit or block malicious instructions introduced through prompt injection attempts, generating alerts when attacks are detected.

For developers and security teams choosing an agentic coding tool, the useful question has fundamentally changed. It is no longer whether the agent has a sandbox. Instead, the critical question is what happens to the files the agent leaves behind and who runs them next.

What Are Enterprises Doing to Manage These Risks?

Enterprise platforms are introducing new controls to govern agents running locally on end-user devices. Microsoft's Agent 365 now includes local agents in its registry, giving IT and security teams a unified view of agents including shadow agents detected within the corporate estate. The registry provides visibility into each agent's publisher, device count, and the date it was last scanned.

Microsoft is also introducing Microsoft Execution Containers (MXC), which enforce a secure, isolated runtime for local agents to bring them under centralized control. With MXC, IT departments can require local agents to run within a hardened Windows container, reducing exposure from unmanaged execution while standardizing security protections across an agent fleet.

Additionally, Agent 365 is expanding its Microsoft Graph API functionality to enable scalable, automated management of AI agents. Two new APIs allow administrators to retrieve a full inventory of agents in the organization for governance and reporting, and to access metadata for specific agents including configuration, ownership, and deployment details.

The pattern of sandbox escapes is not entirely new, but its breadth across multiple vendors and tools signals a systemic challenge in how agentic coding tools are designed and secured. As enterprises continue to deploy these tools at scale, the focus is shifting from preventing agent execution to controlling what agents can write and ensuring downstream systems validate inputs before trusting them.