Security researchers broke out of the sandboxes in four widely used AI coding agents, including Cursor, OpenAI's Codex, Google's Gemini CLI and Antigravity, without attacking the sandbox head-on.
The agent stays inside the box and follows every rule. It just writes a file that a trusted tool outside the box later runs, loads, or scans, and the escape happens on its own.
How the escapes work
Pillar Security's research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes, one write-up a day.
These sandboxes draw a simple line: the agent is trusted inside the project workspace, the host outside is protected.
