Top AI coding agents can be easy victims during sandbox escapes, showing that they are not as secure as they claim to be.

Pillar researchers demonstrated sandbox escapes in AI coding agents
Exploits allow configurations written by attackers to run with trusted host privileges.
Agent security needs its own threat model, researchers say

AI coding agents may be tricked into turning on their operators and helping attackers compromise underlying systems, experts have warned.

Cybersecurity researchers Pillar looked at different methods to achieve the same results, finding that within months, Cursor, Codex, Gemini CLI, and Antigravity were all able to replicate sandbox exits and boundary bypasses.

In theory, a malicious actor could create a repository containing malicious content (e.g., a README file, dependency, or similar) and trick the developer into using it. The malicious instructions instruct the agent to create or modify a project configuration file, but since everything happens inside the workspace, no alarms are raised.

Troubleshoot

Then, a host component outside the sandbox (Git integration, IDE extension, or local daemon) reads this modified configuration and executes the commands written by the attacker. As a result, the code now runs with the privileges of the trusted host component, rather than the restricted AI agent. Voila – the original sandbox boundary is effectively bypassed.

Three of the four platforms mentioned in the report have fixed the issues revealed, Pillar said.

Cursor fixed several vulnerabilities in version 3.0.0, with one assigned CVE-2026-48124 and another tracked via a GitHub security advisory. Codex CLI fixed it in version 0.95.0 but pointed out that it’s still waiting for a CVE. Gemini CLI was affected by the Docker daemon issue, which according to the report was also resolved via advisory GHSA-v4xv-rqh3-w9mc.

For Antigravity, Google recognized the two reported sandbox bypasses as valid security findings, but labeled them “Other valid security vulnerabilities” and reduced their severity. Apparently he finds exploitation rather difficult.

“When it comes to agents, the sandbox boundary that developers expect from coding tools – a boundary that keeps the agent inside the sandbox and the user outside it – breaks down,” Pillar concluded. “The boundary we always found was both more complicated and porous, because if an agent manages to write future input to the systems, that was never sandboxed in the first place.”

“This is why agent security requires its own threat model. »