The sandbox held

Pillar Security spent months probing the sandboxes of four coding agents — Cursor, Codex, Gemini CLI, and Google's Antigravity — and this week published seven escapes. The headline number is not the interesting part. The interesting part is how few of the seven broke the sandbox.

In almost every chain, the agent followed the rules it was given. It wrote a file inside the workspace — the thing sandboxes exist to permit — and something outside the sandbox ran that file later: a Python extension discovering interpreters, a Git integration firing its fsmonitor helper, VSCode loading a project task, Docker Desktop answering its socket. The boundary everyone points to encloses the agent process. The risk lives in what the host trusts after the process is done.

The mechanisms are mundane, which is the point. One escape edited a virtualenv's interpreter and waited for Cursor's unsandboxed Python extension to execute it during discovery. One wrote a .vscode task config that the host later ran on its own. One rode an allowlisted `git show` — safe by name, not by invocation, because Git commands can load config, call helpers, and fire hooks. One talked to the Docker socket, a privileged daemon that amounts to a second, unsandboxed execution environment sitting next to the first. Fixes shipped, a bounty was paid, and advisories are out, CVE-2026-48124 among them.

None of this is exotic. Project config has told machines how to build, test, lint, and launch for decades — .vscode tasks, git hooks, and virtualenvs are how development works. The arrangement was safe because of an unstated assumption: a human wrote those files, or at least a human watched them land. Coding agents end that assumption. They read untrusted input as a matter of routine — READMEs, issues, dependencies, web pages — and they write plausible-looking files at machine speed into the one directory the host treats as trustworthy. Prompt injection stops being a chatbot problem and becomes a local action on the machine that holds your SSH keys and your production tokens.

The vendors come out of this looking better than the pattern does. Disclosure worked: patches landed in Cursor 3.0.0 and Codex 0.95.0, and Pillar tested these four tools precisely because they are the serious ones, with real sandboxes worth testing. But the four failure modes the series names — denylists that are always one entry short, config that is really code, commands trusted by name, daemons that live outside the box — are not bugs in four products. They are properties of the developer endpoint, and every one of them predates agents. You can patch seven chains. You cannot patch the assumption that the workspace is inert.

You can patch seven chains. You cannot patch the assumption that the workspace is inert.

The buying question for an agent vendor used to be whether it has a sandbox. The better question is Pillar's: what can the agent write, and which host components trust those writes? A boundary that lets you author the host's future inputs isn't a boundary. It's a delay.