Cursor, Codex, and Gemini CLI Hit by Sandbox Escapes That Bypass Every Rule

Security researchers have demonstrated that the sandboxes protecting four widely used AI coding agents — Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity — can be escaped without ever attacking the sandbox head-on. The findings, published on July 20, 2026, by Pillar Security's research team and reported by BleepingComputer, expose a structural weakness in how AI coding tools isolate the code their agents generate from the developer machines they run on.

The research is a significant data point for anyone tracking breaking AI news on agent safety, because it shows that even a perfectly compliant agent — one that obeys every rule inside its sandbox — can still break out. The flaw is not in the agent's behavior but in the trust boundary the sandbox assumes.

How the Escapes Work

The key insight is deceptively simple. Modern AI coding agents run inside a sandbox that draws a line: the agent is trusted inside the project workspace, and the host outside is protected. The assumption is that files inside the workspace are inert — data, not commands.

But they are not inert. Tools running outside the sandbox constantly read and act on those files. Integrated development environments resolve Python interpreters, Git integrations scan repositories, VS Code runs task files, hook engines fire commands, and Docker Desktop exposes a local socket. A sandboxed agent can obey every rule it is given and still write a file that one of those external tools later executes, loads, or scans.

According to BleepingComputer's reporting, the escape "happens on its own": the agent stays inside the box, follows every rule, and just writes a file that a trusted tool outside the box subsequently runs. The agent never breaks out; the breakout is done on its behalf by software the developer already trusts.

The Trigger: Prompt Injection

The mechanism that sets these escapes in motion is prompt injection — the same vulnerability that has plagued AI agents across domains. A malicious instruction planted in a README file, a GitHub issue, a project dependency, or a code diff becomes a local action on the developer's machine once the agent processes it.

This connects the sandbox research to a broader pattern in AI security. The agent does not need to be compromised or jailbroken. It simply needs to encounter a poisoned input in the course of its normal work — reading a file, reviewing a pull request, installing a package — and then carry out the embedded instruction by writing the right file in the right place. The sandbox permits the write, because writing files is exactly what a coding agent is supposed to do.

The 'Week of Sandbox Escapes'

Pillar Security's research team — Eilon Cohen, Dan Lisichkin, and Ariel Fogel — reproduced the bypasses over several months and published them as a series they call the "Week of Sandbox Escapes," releasing one write-up per day. The researchers sorted their seven findings into four distinct failure modes.

One category is what they describe as denylist sandboxes — sandboxes that try to block specific dangerous actions rather than permitting only safe ones. Denylists are notoriously fragile because they depend on anticipating every possible attack, and the escapes show how an agent can route around a blocked action by enlisting an external tool that was never on the denylist in the first place.

The four affected tools — Cursor, OpenAI's Codex, Google's Gemini CLI, and Antigravity — represent a broad cross-section of the AI coding agent market, from consumer IDE plugins to enterprise command-line tools. That breadth suggests the problem is not a bug in any single product but a shared architectural assumption that the research invalidates.

Why This Matters for the Agent Economy

The implications extend beyond individual developers. As coding agents are embedded into automated pipelines, continuous integration systems, and autonomous workflows, a sandbox escape becomes a potential foothold for supply-chain attacks. An attacker who can get a poisoned file into a repository — through a dependency, a cloned repo, or a compromised contributor — can conceivably turn a trusted coding agent into an execution vector on a developer's machine.

This is the same class of risk that surfaced earlier in 2026, when researchers found that opening a malicious repository in Cursor could silently execute code on Windows. The sandbox escapes generalize that threat: it is not one tool or one platform, but the interaction model between sandboxed agents and the trusted tools that surround them.

The Hard Problem of Trusted Files

The fundamental difficulty is that a coding agent's sandbox cannot treat all workspace files as untrusted without crippling the agent's usefulness. The agent needs to write code, configuration, and scripts, and those files need to be read and acted on by the developer's tools. Strip away that trust and the agent cannot function; preserve it and the escape vector remains.

Pillar's research does not offer a single drop-in fix, and that is part of why the findings matter. They frame a design problem the industry will have to solve collectively — through stronger isolation between the agent's workspace and the host's execution surface, through signing or attestation of agent-written files, or through rethinking which tools are permitted to auto-execute workspace content at all.

For developers using Cursor, Codex, Gemini CLI, or Antigravity today, the practical takeaway is caution with untrusted inputs: cloned repositories, third-party dependencies, and contributed code should be treated as potentially carrying prompt injection that targets not just the model but the filesystem around it.

Stay Ahead of AI

For ongoing coverage of AI security, coding agents, and the infrastructure risks they introduce, follow our AI industry coverage.

Read more AI news