Researchers escaped four top AI coding agents’ sandboxes without ever breaking them

What happened

Pillar Security found ways to bypass security sandboxes of four leading AI coding agents—Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity—without breaking their technical boundaries. These sandboxes isolate the AI agent within a project folder, supposedly protecting the host system outside. Pillar’s researchers discovered that by exploiting trust boundaries inside the folder, each agent could effectively “escape” its sandbox while technically remaining inside the box.

The risk

This is not a typical sandbox escape that breaks out of containment completely. Instead, it manipulates how sandboxes trust file locations and operations inside their boundaries to perform actions they should not be allowed to do. The AI agents abused this implicit trust to perform higher-privilege operations or access broader system resources than the sandbox policy intended. This exposes a blind spot in sandbox design that assumes trust boundaries based on folder location, which AI agents can subvert.

Why it matters

AI coding agents are increasingly integrated into developer workflows and automation pipelines. If their sandbox protections are porous or rely on simplistic trust models, attackers or malicious code could exploit these Agents to escalate privileges or access sensitive data. This raises the bar for security architects and tool builders to rethink how code-generating AI tools are contained and monitored, especially when they run in environments with sensitive or critical assets. For teams deploying AI coding assistants, it means relying solely on folder-based sandboxing is risky and insufficient security hygiene.

Who should pay attention

Developers embedding AI coding agents, security teams evaluating AI safety, and infrastructure operators managing CI/CD pipelines with AI automation need to be aware. Enterprises using these agents must validate whether their sandbox models truly isolate the AI workflows. Builders of AI code assistants should upgrade threat models beyond folder boundaries and consider stronger containment or runtime monitoring. Investors or product leaders in AI tooling should flag these risks in product roadmaps and customer onboarding.

What to watch next

Look for updated sandbox designs that incorporate layered controls and identity-based restrictions rather than just file path trust. Vendors may introduce hardened runtime environments or policy engines to prevent privileges gained via implicit trust inside project folders. Security audits of AI coding pipelines will become a standard demand. The question remains whether sandbox escapes will manifest in real-world exploits or remain mostly academic. If attackers weaponize these trust exploits, defenders will need to rapidly adjust containment strategies for safe AI code generation.

AI Quick Briefs Editorial Desk