7 Sandbox Escape Vulnerabilities Across 4 Coding Agent Vendors

Summary

Why agentic security needs its own threat modelExecutive SummaryOver several months, Pillar Research found and reproduced sandbox escapes and boundary bypasses across Cursor, Codex, Gemini CLI, and Antigravity. In almost every case, the agent did not need to break the sandbox directly. It only had to write something that a trusted component outside the sandbox would later run, load, scan, or treat as safe. In aggregate, these vulnerabilities show that AI coding agents change the endpoint threat model, and that most sandbox designs have not caught up. We are releasing the research as The Week of Sandbox Escapes: one deep-dive a day, each showing a different route across the boundary. The findings cluster into four repeatable failure modes:Denylist sandboxes that cannot keep pace with OS complexityWorkspace configurations that are really executable code "Safe" command allowlists that trust command names instead of invocations Privileged local daemons that sit outside the sandbox entirelyThe bottom line is that an agent's blast radius is not the agent process; it includes everything the agent can write that the host later trusts. The productivity gains of agents are real, and developers are already using them. The problem is that these tools became infrastructure before most organizations governed them as infrastructure.CISOs and security buyers need to realize that it's not enough for an agentic IDE or CLI to have a sandbox. It needs to prove where the sandbox boundary actually is, what the agent can write, which host components trust those writes, which local daemons it can reach, which commands skip approval, and what telemetry exists when a trusted helper executes something the agent influenced.Agentic tools are becoming endpoint actors. They need to be assessed, monitored, and governed like endpoint actors.‍Pillar’s ApproachAt Pillar, we look at AI adoption through the lens of enterprise risk. Agentic coding tools are a natural place to start because they concentr...