AI Agents Escape Their Sandboxes Without Breaking Them: What's Going Wrong?

What Happened?

Researchers at Pillar Security have published a report detailing how they managed to make four AI coding agents—Cursor, OpenAI Codex, Google Gemini CLI, and Antigravity—escape their sandboxes without breaking them. The technique exploits the trust these environments place in the agent within the project directory: the sandbox protects the host from the agent, but assumes the agent is safe within its folder. Attackers can trick the agent into executing commands or accessing host system resources, all without generating a security alert.

According to the Pillar Security report, the vulnerability lies not in sandbox implementation flaws, but in a design trust error. Sandboxes typically isolate the agent from the host operating system, but grant the agent full access to files and processes within the project directory. An attacker can inject malicious instructions into configuration files, build scripts, or dependencies that the agent processes autonomously. For example, if the agent runs a command like npm install, it can be tricked into reading host environment variables or writing to locations outside the project directory. The researchers demonstrated that, in all cases, the agent acted as an unwitting bridge to the host system, without the sandbox generating any alert.

The research spanned several months and included tests with the latest versions of each tool in early 2026. Pillar Security notified affected vendors before public disclosure, following responsible vulnerability disclosure practices. To date, no official patches have been released, although vendors have acknowledged the issue and are working on updates.

Why Is This Important?

Sandboxes are the primary security barrier in AI tools that execute code autonomously. If an attacker can make the agent act as a bridge to the host system, data, credentials, and the integrity of the development environment are compromised. Given that these tools are used by millions of developers, the potential impact is massive. Moreover, the technique does not require complex vulnerabilities; it exploits implicit trust logic.

Cursor, for example, has over 1.5 million active users according to company data. OpenAI Codex is integrated into GitHub Copilot, used by more than 2 million developers. Google Gemini CLI, though newer, is rapidly being adopted in enterprise environments. Antigravity, an open-source agent, has a plugin ecosystem that expands its attack surface. The combination of these user bases makes any sandbox escape vulnerability globally significant.

Historically, sandbox escapes have been critical cybersecurity events. In 2015, a vulnerability in Adobe Flash's sandbox allowed remote code execution, affecting millions of systems. In 2020, researchers demonstrated escapes in Docker's sandbox via kernel exploits. However, this case is different: it is not an implementation error, but an architectural design problem. The implicit trust in the agent within its working directory is inherent to how these systems were conceived. Redesigning that trust will require fundamental architectural changes.

The market impact could be significant. Companies integrating AI agents into their CI/CD pipelines or local development environments will need to reassess their risks. Startups building on these platforms may face delays if vendors do not provide quick fixes. In the worst case, a targeted attack could leak API tokens, SSH keys, or even proprietary source code.

Consequences and Recommendations

Companies integrating AI agents into their workflows should review their security policies and consider network segmentation, anomalous behavior monitoring, and limiting agent permissions. Developers should be aware that the sandbox is not infallible and avoid running unverified code. In the long term, vendors need to redesign the trust architecture of these systems.

Pillar Security recommends several immediate mitigations. First, run agents in containers with strict security policies, such as Docker containers with reduced capabilities or ephemeral virtual machines. Second, monitor agent system calls using tools like seccomp or AppArmor. Third, limit agent access to environment variables and sensitive files, even within the project directory. Fourth, implement human review for commands that modify the host system.

For individual developers, recommendations include not running agents with superuser privileges, manually reviewing configuration files before the agent processes them, and using virtual environments or containers for projects requiring external dependencies. It is crucial to understand that layered security remains the best defense: no sandbox is infallible.

In the long term, vendors should consider a zero-trust model for agents, where every action is verified and explicitly authorized. This could involve cryptographic signing of commands, mutual authentication between agent and sandbox, or execution in isolated environments with internal firewall policies. Some experts suggest that the ultimate solution may require a new industry standard for AI sandboxes.

What You Need to Know

• The escape does not require breaking the sandbox, but manipulating the agent's trust.
• Cursor, Codex, Gemini CLI, and Antigravity are affected.
• Pillar Security notified vendors before disclosure.
• No immediate patches; mitigation depends on additional configurations.
• The technique was demonstrated in multiple scenarios, including injection via dependencies and project files.
• Potential impact ranges from credential leakage to remote code execution on the host.
• The researchers published a proof-of-concept video for each agent, available on their website.

“The sandbox is not a magic solution; security must be layered,” the researchers warn.