The Week of Sandbox Escapes: AI coding-agent sandbox bypasses (CVE-2026-48124 and more)
Disclosed vulnerability20 Jul 2026 – 23 Jul 2026🗺️ Tool-Using AgentPillar Security reportedly disclosed eight sandbox-escape vulnerabilities across four AI coding agents (Cursor, OpenAI Codex CLI, Google Gemini CLI, Google Antigravity) over four days, finding that in nearly every case the agent did not break the sandbox directly but wrote a file that a trusted component outside the sandbox later ran, loaded or scanned.
Root cause — why it happened
AI coding assistants run the commands they write inside a locked 'sandbox', so a bad command can't touch the rest of your computer. Researchers found the sandbox almost never had to be broken. Staying entirely inside its box and following every rule, the assistant simply wrote an ordinary-looking file into your project folder. Then a separate, trusted program on your machine — your editor, a language plug-in, a background helper — automatically opened or ran that file, with your full user rights, outside the box. The trap wasn't sprung by breaking the lock; it was sprung by a trusted helper that never knew the file came from the AI.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
A sandboxed coding agent on an ordinary project
A developer runs an AI coding assistant on a project and asks it to do something normal — fix a bug, add a feature. The assistant can run commands and write files, but it does so inside a locked sandbox so a bad command can't reach the rest of the computer. That sandbox is exactly what everyone is trusting to keep them safe.
Controls & guardrails — what would have stopped it
The fix that actually closes this is to stop treating 'it's in the project folder' as safe. Every program that automatically runs or opens a file the AI could have written must be inside the same locked box, or must ask a person first — and the AI shouldn't be allowed to write the special files that make other programs run on their own. Then, even a tricked assistant that writes a file has nowhere for that file to escape to.
- Tool argument validation & sandboxing
Validates form, not intent — a well-formed call to a permitted tool can still be the wrong call. Sandboxing adds latency and isn't always feasible for tools that touch production.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- Per-agent identity & taint-marked messagesaddressesExcessive Agency
Adds coordination overhead and doesn't stop a worker from returning subtly wrong (but well-formed) results that mislead the planner.
- Egress allowlisting & DLP on tool arguments
Allowlists fight an open-ended channel; legitimate-but-broad destinations (any URL fetch, any email) are hard to constrain without breaking usefulness. Encoding can evade naive DLP.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
- Loop/cost circuit-breakers & consistency checksaddressesExcessive Agency
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
Lessons
- ▸ A sandbox that contains the agent process but not the trusted tools that later read its files is not containment — the boundary must include the file's future readers.
- ▸ If an agent can write a file that a trusted host tool later runs, loads or scans, it can escape — no sandbox-breaking exploit required.
- ▸ Config-as-code is code: hooks, task files, interpreter paths and metadata that a host tool auto-executes must not be writable by the agent without consent.
- ▸ Allowlist the invocation, not the command name — trusting `git show` by name is worthless if the actual invocation isn't read-only.
- ▸ Least-privilege on the developer host and unreachable daemon sockets shrink the blast radius of any escape that still gets through.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
A sandbox escape achieved without breaching the sandbox or its enforcer at all: the agent, acting entirely within its permitted scope, writes an ordinary-looking file into its writable workspace, and a trusted host component OUTSIDE the sandbox (an IDE language/Python extension, a hook or task engine, a filesystem watcher/scanner, or a privileged local daemon such as the Docker socket) later runs, loads or scans that file with the developer's full ambient privileges. Execution is deferred, so no approval gate fires. Config-as-code is the common carrier — a `.claude` hook, a `.vscode` task, a swapped virtualenv interpreter, or crafted git metadata — and indirect prompt injection is the usual trigger, though any agent that can write such a file can escape.
Where a sandboxed agent can write files, treat every trusted host tool that later runs, loads or scans those files as part of the containment boundary. (1) Enumerate the deferred-execution paths from agent-writable state to unsandboxed action — hook/task engines, IDE interpreter discovery, filesystem watchers/scanners, and privileged daemon sockets (e.g. Docker). (2) For each, either run the consumer inside the same sandbox, require explicit developer consent before it acts on an agent-written file, or deny the agent write access to the trigger path (`.claude`/`.vscode`/interpreter/`.git` metadata). (3) Keep privileged daemon sockets unreachable from the workspace, and validate the actual command invocation rather than trusting a command name (e.g. a read-only `git show` allowlist that doesn't pin the invocation). (4) Run host consumers under least privilege so a residual escape inherits minimal authority. Closes the 'Week of Sandbox Escapes' vector where an agent that never breaks its sandbox writes a file a trusted out-of-sandbox tool executes; complements — does not rely on — injection filtering, MCP pinning, and egress control. Distinct from sandbox self-integrity hardening: the enforcer here is intact; the gap is that it never enclosed the consumer.
This case shows a gap people miss: we say 'run risky things in a sandbox' and assume the sandbox is the safety boundary — but here the sandbox was never broken. The AI wrote a normal file, and a different, trusted program on the computer ran it outside the box. We should check not just that the agent is sandboxed, but that nothing trusted outside the sandbox will automatically act on the files the agent can write.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- The Week of Sandbox Escapes — Pillar Security ↗
- BleepingComputer ↗
- Pillar Security — The Week of Sandbox Escapes (series overview) ↗ — Primary disclosure; the cross-vendor structural finding and the four repeatable failure modes.
- Pillar Security — Day 6: The hook was already in the workspace ↗ — Cursor `.claude/settings.local.json` Stop-hook executed at end-of-turn without approval (CVE-2026-48124).
- Pillar Security — Day 2: One Docker socket to rule them all ↗ — Privileged Docker daemon socket reachable from the workspace escapes Codex, Cursor and Gemini CLI sandboxes.
- NVD — CVE-2026-48124 ↗ — Cursor executes workspace-defined Claude hook commands without dedicated approval; fixed in 3.0.0. CVSS 8.5 is as reported, not independently confirmed.
- BleepingComputer — Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes ↗ — Secondary reporting: seven findings across the seven-day series; the Codex CLI `git show` allowlist bypass was fixed in 0.95.0; Google downgraded its two Antigravity findings.
Practise the risk class — related scenarios
An 'Ask AI' button quietly plants a permanent 'trusted source' rule in your assistant's memory
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A support email hides instructions — and the assistant obeys them
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
An auto-approving coding agent reads a poisoned page — and executes code it never should have
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
Every command is harmless on its own — the sequence is the exploit
The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later
A shopping page tells the agent to do something the user never asked for
One click provisions an attacker-configured agent inside your own workspace
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
A single poisoned document plants a standing instruction that survives every reset
Encoded public text is laundered across an agent handoff into an on-chain transfer
A screenshot that's harmless at full size becomes an order once the system shrinks it
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
The eval gate that was supposed to catch the agent is itself the thing being attacked
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'
An inbox summary quietly ships a secret to an attacker's server