AI agents can escape sandboxes without ever breaking them
Summary
AI coding agents can bypass security restrictions without technically breaking out of sandboxes (isolated execution environments) by creating files that trusted programs outside the sandbox later execute or read. Researchers at Pillar Security demonstrated this vulnerability in tools like Cursor, Codex, Gemini CLI, and Antigravity, showing that agents can manipulate configuration files, scripts, and virtual environments to indirectly run code with higher privileges outside their restricted environments.
Solution / Mitigation
The source recommends treating workspace configurations that trigger execution as sensitive assets requiring explicit approval before agents create or modify them, ensuring helper processes operate under the same security policy as direct agent execution, preserving provenance (a record distinguishing user-created files from agent-generated ones) to track file origins, modeling security policies around command side effects rather than just process invocation, limiting access to privileged local services, and monitoring trust handoffs throughout the development workflow. However, the source does not describe specific patches, version updates, or concrete implementation details for these recommendations.
Classification
Affected Vendors
Related Issues
Original source: https://www.csoonline.com/article/4199408/ai-agents-can-escape-sandboxes-without-ever-breaking-them.html
First tracked: July 21, 2026 at 08:01 AM
Classified by LLM (prompt v3) · confidence: 85%