--- title: AI agents can escape sandboxes without ever breaking them description: Pillar Security has disclosed vulnerabilities in AI coding tools including Cursor, Codex CLI, Gemini CLI, and Antigravity showing how sandboxed agents can... canonical: https://daily.dev/posts/ai-agents-can-escape-sandboxes-without-ever-breaking-them-vijocdk05 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI agents can escape sandboxes without ever breaking them | daily.dev og:description: Pillar Security has disclosed vulnerabilities in AI coding tools including Cursor, Codex CLI, Gemini CLI, and Antigravity showing how sandboxed agents can... og:url: https://daily.dev/posts/ai-agents-can-escape-sandboxes-without-ever-breaking-them-vijocdk05 og:image: https://api.daily.dev/og/posts/VIjoCDK05.png og:image:alt: AI agents can escape sandboxes without ever breaking them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI agents can escape sandboxes without ever breaking them **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments ## Summary Pillar Security has disclosed vulnerabilities in AI coding tools including Cursor, Codex CLI, Gemini CLI, and Antigravity showing how sandboxed agents can cross security boundaries without technically escaping their sandboxes. Rather than kernel exploits or container breakouts, the attacks rely on agents writing files — workspace configs, Python virtual environments, Git hooks, IDE settings — that trusted host-side software later executes outside the sandbox. Four repeatable failure modes were identified: denylist sandboxes failing against OS complexity, workspace configs being executable code, command allowlists trusting names over invocations, and privileged local daemons sitting outside the sandbox. Researchers recommend treating agent-created workspace files as sensitive assets, requiring explicit approval for host-side automation changes, and modeling security policies around command side effects rather than process invocation alone. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [AI Coding Agent Horror Stories: Security Risks Explained](https://daily.dev/posts/ai-coding-agent-horror-stories-security-risks-explained-vv12xoikj) · Docker · 0 upvotes · 0 comments - [AI Agent Security: Six Controls From Nine Real Incidents](https://daily.dev/posts/ai-agent-security-six-controls-from-nine-real-incidents-hpa9kjz2r) · GitGuardian · 0 upvotes · 0 comments - [How AI Coding Tools Crushed the Endpoint Security Fortress](https://daily.dev/posts/how-ai-coding-tools-crushed-the-endpoint-security-fortress-oivfawpcr) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ai-agents-can-escape-sandboxes-without-ever-breaking-them-vijocdk05) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI agents can escape sandboxes without ever breaking them","url":"https://daily.dev/posts/ai-agents-can-escape-sandboxes-without-ever-breaking-them-vijocdk05","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agents-can-escape-sandboxes-without-ever-breaking-them-vijocdk05"},"datePublished":"2026-07-21T11:48:41.792Z","dateModified":"2026-07-21T11:50:37.218Z","description":"Pillar Security has disclosed vulnerabilities in AI coding tools including Cursor, Codex CLI, Gemini CLI, and Antigravity showing how sandboxed agents can...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fa3d0d78c23deb30b6bbf696c74c533a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fa3d0d78c23deb30b6bbf696c74c533a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agents-can-escape-sandboxes-without-ever-breaking-them-vijocdk05","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"AI agents can escape sandboxes without ever breaking them"}]} ```