Pillar Finds Seven Sandbox Escapes Across Four Coding Agents
Pillar Security disclosed seven sandbox escapes and boundary bypasses affecting Cursor, OpenAI Codex, Gemini CLI and Google Antigravity on July 20. The common failure was indirect: agents wrote workspace files or reached local services that trusted components outside the sandbox later executed. Pillar and independent reporting say most issues were patched, while Google downgraded the two Antigravity reports as difficult to exploit.
Pillar Security published a seven-part research series on July 20 describing sandbox escapes and boundary bypasses across Cursor, OpenAI Codex, Gemini CLI and Google Antigravity. The findings do not all involve an agent directly breaking an operating-system sandbox. Instead, they show how actions allowed inside a workspace can cross the boundary when unsandboxed host components later trust what the agent wrote or can reach.
The boundary failed outside the agent process
Pillar grouped the seven findings into four patterns: denylist sandboxes that miss operating-system behavior, workspace configuration that can execute code, command allowlists that trust a program name without evaluating its arguments, and privileged local daemons available outside the sandbox.
One Codex CLI finding illustrates the distinction. Pillar reported that git show was treated as a safe command, even though its --output and --format options could write attacker-controlled content into .git/config. A later git diff could then invoke the configured external tool with the user's privileges. OpenAI patched the issue in Codex CLI v0.95.0 after receiving the report in January, according to Pillar.
Other chains used workspace-controlled hooks, virtual-environment interpreters, Git metadata indirection, VS Code task configuration, or access to a Docker socket. In each case, the agent could remain within its stated workspace permissions while influencing a component that ran outside those permissions.
Most findings were fixed, but vendor treatment differed
BleepingComputer reported that Cursor fixed its affected hook, virtual-environment and Git-metadata paths, including a fix in Cursor 3.0.0 for the hook issue tracked as CVE-2026-48124. The shared Docker-socket issue affecting Cursor, Codex and Gemini CLI was also reported fixed.
Pillar's master report records a different outcome for two Antigravity findings. Google classified them as valid security issues but downgraded their severity because exploitation would require social engineering or trusting a repository containing indirect prompt injection. Pillar's table does not list those two reports as patched.
What development teams should change
The practical lesson is broader than any one product. A sandbox review should cover not only what the agent process can execute, but also which files it can modify, which host tools consume those files, and which local services it can contact. LDS interpretation: teams using coding agents should treat workspace configuration, helper discovery and daemon access as part of the effective execution boundary, then verify versions and vendor advisories for each deployed tool.
Key Points
- 1Pillar disclosed seven sandbox escapes and boundary bypasses across Cursor, Codex, Gemini CLI and Antigravity on July 20.
- 2The recurring flaw was a trust handoff: agents influenced files, commands or services that unsandboxed host components later executed.
- 3Most findings were reported fixed, while Google downgraded the two Antigravity reports as difficult to exploit.
Scoring Rationale
A coordinated disclosure spanning four widely used coding-agent products exposes a repeatable class of host-boundary failures. Most known paths are patched, reducing immediate exposure, but the cross-vendor pattern is highly relevant to teams deploying agents with developer credentials and local tool access.
Sources
Primary source and supporting public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Ad Tech problems
