Top AI coding agents can be easy victims to sandbox escapes, showing they aren't as secure as they claim to be

Date:
Tue, 21 Jul 2026 11:20:00 +0000

Description:
What if a host component outside the sandbox reads AI coding agents' output? And what if that output is manipulated?

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Pillar researchers demonstrated sandbox escapes in AI coding agents Exploits let attackerwritten configs run with trusted host privileges Agentic security needs its own threat model, researchers claim AI coding agents can be tricked into turning on their operators and assisting attackers in compromising the underlying systems, experts have warned.

Cybersecurity researchers Pillar have examined different methods of achieving the same results, finding that over the course of a couple of months, Cursor, Codex, Gemini CLI, and Antigravity were all able to reproduce sandbox escapes and boundary bypasses. In theory, a threat actor could create a repository containing malicious content (for example, a README file, a dependency, or similar) and trick the developer into using it. The malicious instructions tell the agent to create or modify a project configuration file, but since everything happens inside the workspace, no alarms are triggered. Latest Videos From Watch full video here: Fixing the problems Then, a host component outside the sandbox (Git integration, an IDE extension, or local daemon)
reads that modified configuration, executing attacker-written commands. Consequently, the code now runs with the privileges of the trusted host component, rather than the restricted AI agent . Voila - the original sandbox boundary is effectively bypassed.

Three of the four platforms mentioned in the report have fixed the disclosed issues, Pillar said. You may like Phishing the agent: Why AI guardrails arent enough What the OpenClaw vulnerability reveals about the future of agentic AI security Shadow AI and agents like OpenClaw are hijacking corporate data too easily

Cursor patched multiple vulnerabilities in version 3.0.0, with one assigned CVE-2026-48124 and another tracked through a GitHub Security Advisory. Codex CLI fixed it in version 0.95.0 but stressed that its still awaiting a CVE. Gemini CLI was affected by the Docker daemon issue, which the report says has also been fixed through advisory GHSA-v4xv-rqh3-w9mc.

For Antigravity, Google acknowledged both reported sandbox bypasses as valid security findings but labeled them Other valid security vulnerabilities and downgraded their severity. Apparently - it considers exploitation rather difficult. Are you a pro? Subscribe to our newsletter Sign up to the
TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

When it comes to agents, the sandbox boundary that developers expect in
coding tools -- one that keeps the agent inside the sandbox and the user outside -- breaks down, Pillar concluded. The boundary we kept finding was both messier and porous, because If an agent gets to write the future inputs of systems, it was never sandboxed in the first place.

This is why agentic security requires its own threat model. The best
antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/top-ai-coding-agents-can-be-easy-victim s-to-sandbox-escapes-showing-they-arent-as-secure-as-they-claim-to-be


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)