Four Widely Used AI Coding Agents Hit by Sandbox Escapes, Exposing Developers to Malicious Attacks
Security researchers have discovered a critical vulnerability in four popular AI coding agents, allowing attackers to bypass sandbox protections and execute malicious code on developers’ machines. The affected tools include Cursor, OpenAI’s Codex CLI, Google’s Gemini CLI, and Antigravity. This is not an isolated incident; the same issue has been observed across multiple vendors and platforms.
The vulnerability works by exploiting a fundamental flaw in how these agents interact with their host environments. When an agent writes a file within its sandboxed workspace, it can be read and executed by external tools running outside the sandbox. This creates a backdoor for malicious actors to inject instructions into the agent’s code, which are then carried out on the developer’s machine without explicit permission.
The attackers don’t need to directly target the sandbox; instead, they plant a malicious instruction in a seemingly innocuous file, such as a README or an issue description. This prompt injection triggers a local action on the developer’s machine, allowing the attacker to execute code with elevated privileges.
Researchers at Pillar Security identified four failure modes that enable this vulnerability:
1. Denylist sandboxes: These systems struggle to keep pace with the operating system, creating vulnerabilities.
2. Workspace config as executable code: When workspace configurations are treated as executable files, they can be exploited.
3. “Safe” command allowlists: These lists trust a command’s name rather than its arguments, making it easy for attackers to inject malicious instructions.
4. Privileged local daemons: Some tools run outside the sandbox entirely, exposing developers to risk.
Most of the issues have been patched by the vendors, but some are still pending CVE assignments. The fixes involve watching for the moment a trusted tool runs something written by the agent, rather than relying on lists of banned filenames.
This vulnerability highlights a critical problem: even with sandboxed agents, the files they write can pose a risk to developers. This is not just an issue for these four tools; it’s a widespread problem that affects multiple vendors and platforms.
To protect themselves, developers should test every layer of their security setup before attackers do. Security teams often struggle to detect threats due to inadequate testing and training. By conducting regular breach and attack simulation tests, organizations can identify vulnerabilities and improve their detection capabilities.
As the use of AI coding agents continues to grow, it’s essential for developers and security teams to be aware of these risks and take proactive steps to mitigate them.
Source: Bleeping Computer — 2026-07-20