AI-agent sandboxes are only as tight as the host tools

The interesting thing about Pillar Security’s week of sandbox escapes — six distinct instances across Cursor, OpenAI Codex CLI, Google Gemini CLI, and Google Antigravity — is that none of the escapes actually leave the sandbox. The agent obeys every rule inside the shell it’s given. It writes a hook config, a git helper path, a virtualenv shim, a .vscode/tasks.json, a Docker socket call — all things the sandbox permits. Then a trusted host tool outside the sandbox reads that file later, in a context without the sandbox’s constraints, and runs what’s in it. The isolation was intact right up until the moment your own editor re-opened the workspace.

Read Pillar’s writeup for the specific vectors. What’s worth pulling out here is the sentence that describes the class as a whole: the sandbox is only as tight as the least-scoped host tool that reads what’s inside it. Every git client, every editor, every language runtime, every container daemon on the workstation is a boundary the sandbox does not control and cannot see. The agent’s threat model stops at the shell’s edge; the operator’s threat model doesn’t.

That is not a new problem. It is the CGI-bin problem — hand a request handler a shell, then act surprised when the shell does what shells do — with the request-handler role swapped for the agent role and the network wire replaced by a filesystem the host tools will trust on the next invocation. The transport is different. The trust break is the same one that carried through server-side includes, PHP shared hosting, unrestricted eval, insecure deserialization, and every intermediate abstraction that ever let something untrusted describe code that a trusted process ran. Same mistake, different decade. Cymulate documented the same shape back in April 2026 across Claude Code, Gemini CLI, and Codex CLI and called it “configuration-based sandbox escape.” Pillar’s contribution is six more of them in tools that had already been notified and had already shipped hardening. That is what tells you the design assumption is wrong, not the individual bugs.

The AI-agent layer on top of that is the interesting part. In one week we watched Hugging Face confirm an autonomous agent framework breached its internal datasets and service credentials — “many thousands of individual actions across a swarm of short-lived sandboxes,” in the company’s own words. We watched Trend Micro publish an eight-node Gemini-CLI-controlled botnet running on dental-clinic PCs, the LLM CLI turned into the C2. We watched a ransomware family named JadePuffer specifically target model weights and vector databases rather than the file share behind them. Read as a bundle, these aren’t four unrelated stories. They are four different actors — a research team, an unnamed operator, an incident-of-record at a large vendor, a ransomware crew — all discovering the same thing in the same week: that an AI agent is a code-execution surface with a mailing address, and one that a lot of organizations handed keys to without noticing.

None of this is a call to switch the tools off. Coding agents are useful, and the vendors are responding: Cursor shipped 3.0.0, OpenAI shipped Codex CLI 0.95.0 and paid a high-severity bounty, Google’s classification argument on the downgraded Antigravity findings is defensible even where the fix isn’t. What deserves rethinking is scope. If your engineers run Cursor or Codex or Gemini CLI against repositories they did not write themselves, treat the workspace like every other untrusted input: the tokens the agent holds are as sensitive as the tokens any other service holds, and rotation on suspicion is the discipline, not one-off audits after a public disclosure. The host tools those agents write files for — the editor, the shell, git, the container runtime — are the boundary that will matter this week and next. Patching the agent is the small piece of the work.

The people who decide which processes run with which authority, on which files, at which time have been the whole job for a very long time. That job did not get easier when the process learning to speak your language moved into your IDE.