Research · curated 20 Jul 2026
The Week of Sandbox Escapes
First reported · updated · 2 reports pillar.security
Coverage timeline
Why it matters
AI coding agents are widely trusted inside developer workspaces, and this research shows their sandboxes can be turned into arbitrary host command execution via indirect prompt injection, threatening every developer machine running these tools.
Pillar Security researchers (Eilon Cohen, Dan Lisichkin, Ariel Fogel) published 'The Week of Sandbox Escapes,' demonstrating seven ways to break out of the sandboxes in four AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — without attacking the sandbox directly. A prompt injection planted in a README, issue, dependency, or diff drives the sandboxed agent to write workspace files (e.g. a .claude hook config, a virtualenv interpreter, or Git fsmonitor metadata) that trusted tools running outside the sandbox later execute, achieving host command execution; one Cursor issue is tracked as CVE-2026-48124 and fixed in v3.0.0.
Summary
Pillar Security's research team publicly disclosed seven vulnerabilities across four widely used AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity — under a daily series called the Week of Sandbox Escapes. Rather than attacking the sandbox directly, the researchers demonstrated that a sandboxed agent can obey every rule while writing files that trusted tools outside the sandbox later run, load, or scan, converting a permitted file write into host code execution.[1][2]
The trigger is prompt injection: a malicious instruction planted in a README, an issue, a dependency, or a diff becomes a local action on the developer's machine. Pillar sorts the findings into four failure modes — denylist sandboxes that cannot keep pace with the OS, workspace config that is really executable code, 'safe' command allowlists that trust a command's name rather than its arguments, and privileged local daemons sitting outside the sandbox entirely.[1]
Most issues are patched and vendor-acknowledged, including a Cursor bug tracked as CVE-2026-48124 (fixed in 3.0.0) and a Codex CLI allowlist bug fixed in v0.95.0. The class is not new — Cymulate documented the same 'Configuration-Based Sandbox Escape' pattern in April — but the notable new signal is its breadth across four tools from three vendors.[1]
Attack chain
- Injection / Initial trigger: A malicious instruction (indirect prompt injection) is planted in content the agent processes — a README, an issue, a dependency, or a diff.[1]
- In-sandbox file write: The sandboxed agent, obeying its rules, writes or edits a file inside the trusted project workspace (e.g., a .claude hook config, a virtualenv interpreter, Git fsmonitor metadata, or a .vscode task file).[1]
- Out-of-sandbox execution: A trusted tool running outside the sandbox — a Python extension resolving interpreters, a Git integration scanning the repo, VS Code running task files, a hook engine, or Docker Desktop's local socket — reads or acts on the agent-written file, executing code on the host.[1]
Disclosure timeline
| Date | Event |
|---|---|
| April 2026 | Cymulate documents the same pattern, named 'Configuration-Based Sandbox Escape,' across Claude Code, Gemini CLI and Codex CLI.[1] |
| July 20, 2026 | Pillar Security publishes the Week of Sandbox Escapes series and BleepingComputer reports the seven findings across four AI coding agents.[1][2] |
How it works
The sandboxes draw a trust line: the agent is trusted inside the project workspace while the host outside is protected. The flaw is that files inside the workspace are not inert — tools running outside the sandbox read and act on them, so a file the agent is allowed to write can turn into a command the host later runs.[1]
IDEs and CLI agents constantly run their own tools outside the sandbox: Python extensions resolving interpreters, Git integrations scanning repos, VS Code running task files, hook engines firing commands, and Docker Desktop exposing a local socket. A sandboxed agent can obey every rule and still shape the files those components read.[1]
Concrete instances: a Cursor .claude hook config became unsandboxed command execution (CVE-2026-48124); a second Cursor bug let the agent edit a virtualenv interpreter the Python extension then ran during discovery; a third abused Git metadata not needing to live in a folder called .git, firing execution through fsmonitor to slip past Cursor's path-based rules; a Codex CLI allowlist trusted 'git show' by name while the actual invocation was not read-only; and a Docker socket exposed a privileged local daemon the agents could reach.[1]
The two Antigravity findings were a macOS Seatbelt denylist bypass and a .vscode task-config bypass of its Secure Mode.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Cursor (.claude hook config command execution, CVE-2026-48124) | Versions before 3.0.0 | Fixed in version 3.0.0[1][2] |
| Cursor (Git fsmonitor path-rule bypass) | Versions before 3.0.0 | Patched in 3.0.0, CVE pending[1] |
| Cursor (virtualenv interpreter execution via Python extension) | Cursor with Python extension interpreter discovery | Vendor-acknowledged and patched per report[1] |
| OpenAI Codex CLI (git show allowlist bypass) | Versions before v0.95.0 | Patched in v0.95.0; high-severity bounty paid, CVE pending[1] |
| Codex, Cursor and Gemini CLI (Docker socket / privileged local daemon) | All three agents reachable to the local Docker daemon | Fixed[1] |
| Google Antigravity (macOS Seatbelt denylist bypass and .vscode Secure Mode bypass) | Antigravity on macOS | Classified by Google as 'Other valid security vulnerabilities' and downgraded[1] |
Key takeaways
- The vulnerability class is a design pattern, not a single bug: sandboxes trust files inside the workspace as inert, but trusted tools outside the sandbox execute them, so obeying every sandbox rule is not sufficient to prevent host compromise.[1]
- The pattern is not new — Cymulate documented 'Configuration-Based Sandbox Escape' in April — but its breadth across four tools from three vendors is the more useful signal when evaluating agentic coding tools.[1]
- The four recurring failure modes are denylist sandboxes that lag the OS, workspace config that is executable code, allowlists that trust command names over arguments, and privileged local daemons outside the sandbox.[1]
Defensive actions
- Update the affected AI coding agents to patched releases — Cursor 3.0.0 and Codex CLI v0.95.0.: These versions fix the disclosed sandbox-escape vulnerabilities, including CVE-2026-48124 and the Codex git show allowlist bypass.[1][2]
- Treat repositories, issues, dependencies and diffs opened in agentic coding tools as untrusted input capable of indirect prompt injection.: Prompt injection planted in such content is the trigger that turns an in-sandbox file write into host code execution.[1]
- Monitor the moment a trusted local tool runs something the agent wrote, rather than relying on lists of banned filenames.: Pillar's recommended fix targets the execution event because denylist sandboxes cannot keep pace with the operating system.[1]