The tools are Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity. Over several months, Pillar Security found ways for each agent to cross its security boundary while staying, technically, inside the box.
The escape that isn’t one
The trick is neat. These sandboxes trust the agent inside the project folder and protect the host outside. But the files in that folder are not inert.
Tools running outside the sandbox read them. A Python extension resolves an interpreter, a Git integration scans a repo, Docker Desktop exposes a local socket. So a file the agent is allowed to write can become a command the host later runs, as BleepingComputer explains.
The trigger is prompt injection. A malicious instruction hidden in a README, an issue, a dependency, or a diff turns into a real action on the developer’s machine.
