--- title: AI coding agent sandbox escapes disclosed, RubyGems... description: Pillar Security disclosed sandbox escape vulnerabilities in Cursor, Codex CLI, Gemini CLI, and Antigravity — the agents don't break out directly, they write... canonical: https://daily.dev/posts/ai-coding-agent-sandbox-escapes-disclosed-rubygems-leaks-api-keys-for-nine-years-koy7wpikn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI coding agent sandbox escapes disclosed, RubyGems leaks API keys for nine years | daily.dev og:description: Pillar Security disclosed sandbox escape vulnerabilities in Cursor, Codex CLI, Gemini CLI, and Antigravity — the agents don't break out directly, they write... og:url: https://daily.dev/posts/ai-coding-agent-sandbox-escapes-disclosed-rubygems-leaks-api-keys-for-nine-years-koy7wpikn og:image: https://api.daily.dev/og/posts/Koy7wPIKN.png og:image:alt: AI coding agent sandbox escapes disclosed, RubyGems leaks API keys for nine years og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI coding agent sandbox escapes disclosed, RubyGems leaks API keys for nine years **[Security Digest](https://daily.dev/sources/security_digest)** · 6 min read · 2 upvotes · 1 comments ## Summary Pillar Security disclosed sandbox escape vulnerabilities in Cursor, Codex CLI, Gemini CLI, and Antigravity — the agents don't break out directly, they write files that trusted host-side tools later execute. Separately, RubyGems.org disclosed a nine-year CDN caching bug that exposed legacy API keys to other users at the same edge node. On the supply chain front, npm campaigns targeting AI coding assistant credentials are now injecting malicious hooks directly into Claude Code and Cursor config files, and a new study found 53 hallucinated package names across five frontier LLMs that remain available for malicious registration. The OpenAI sandbox escape story from the previous digest has new detail: Anthropic published its own containment architecture post, and the authorization gap between safety classifiers and runtime enforcement is getting serious attention. ## Content **TLDR:** Pillar Security disclosed sandbox escape vulnerabilities in Cursor, Codex CLI, Gemini CLI, and Antigravity — the agents don't break out directly, they write files that trusted host-side tools later execute. Separately, RubyGems.org disclosed a nine-year CDN caching bug that exposed legacy API keys to other users at the same edge node. On the supply chain front, npm campaigns targeting AI coding assistant credentials are now injecting malicious hooks directly into Claude Code and Cursor config files, and a new study found 53 hallucinated package names across five frontier LLMs that remain available for malicious registration. The OpenAI sandbox escape story from the previous digest has new detail: Anthropic published its own containment architecture post, and the authorization gap between safety classifiers and runtime enforcement is getting serious attention. --- ## Sandbox escapes in Cursor, Codex CLI, Gemini CLI, and Antigravity: agents write files, host tools execute them Pillar Security disclosed seven findings across four AI coding agents. The core mechanic is indirect: agents write files inside the workspace that trusted host-side tools — Python extensions, Git hooks, VS Code task runners — later pick up and run. The sandbox boundary stays intact; the blast radius expands around it. Cursor patched its flaw (CVE-2026-48124) in version 3.0.0, Codex addressed its issues in v0.95.0. Google downgraded its two Antigravity findings, arguing they require social engineering. Attack vectors include prompt injection through README files, code comments, and dependencies — an attacker just needs to get malicious content into something the agent reads. Pillar's proposed fix is behavioral: watch for when trusted local tools execute files an agent wrote, rather than maintaining denylist-based filename rules. [Read more](https://daily.dev/posts/gTJSqcy0E) ## RubyGems CDN caching bug exposed legacy API keys for nine years RubyGems.org disclosed a CVSS 7.2 vulnerability that existed from October 2016 until July 2026. A misconfiguration involving Rack::Deflater, Rack::ETag, and Fastly CDN cache headers caused the legacy API key sign-in endpoint to cache authenticated responses at edge nodes. When a user signed in with a gem client older than v3.2.0, their newly created API key could be served to the next requester hitting the same Fastly edge node within an hour. The bug affected 18% of current gem signin calls and, before December 2020, every gem client. All legacy API keys have been revoked, the endpoint retired, and cache headers fixed to set Cache-Control: private, no-store. No evidence of malicious exploitation was found, though log history is limited — review your gems for unauthorized versions, yanks, or ownership changes. [Read more](https://daily.dev/posts/1KiNyg7VU) ## npm campaigns now injecting malicious hooks into Claude Code and Cursor config files Three related npm campaigns — Shai-Hulud, Mini Shai-Hulud, Miasma, and Sandworm_Mode — are exploiting the trust signals the ecosystem spent years building. The core problem is inherited signatures: attackers compromise upstream pipelines before packages get signed, so SLSA provenance and OIDC-minted signatures are genuine. Sandworm_Mode spread across 19 packages and produced reliable detection signals for only 2 of 14 distinct malicious behaviors, exfiltrating credentials over DNS tunneling with a 48-96 hour activation delay. Mini Shai-Hulud goes further by injecting malicious SessionStart hooks into Claude Code's settings.json, Cursor's .cursorrules, and Copilot instruction files — the payload runs every time a developer opens an AI coding session. There's also a clear-bomb technique: embedding content that causes AI-based scanners to refuse analysis, turning scanner refusal into a detection-evasion strategy. [Read more](https://daily.dev/feed-by-ids?id=cqFy0sIns&id=G68bUQQBP) ## 53 hallucinated package names across five frontier LLMs remain available for malicious registration A preprint study analyzed roughly 200,000 code-generation responses from Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, and DeepSeek V3.2, finding hallucination rates between 4.62% and 6.10%. Critically, 127 nonexistent package names were generated by all five models, and after review by PyPI Security and Socket, 53 of those names — 41 on PyPI, 12 on npm — remain available for malicious registration. A single registration could target users across multiple AI coding tools simultaneously. Treat all AI-suggested dependencies as unverified until reviewed. [Read more](https://daily.dev/posts/6t7a1jnZb) --- ## Also notable - **PyPI now rejects file uploads to releases older than 14 days:** The change was motivated by real incidents: LiteLLM and Telnyx were both compromised through a mutable reference in the Trivy GitHub Action, letting attackers slip malicious files into old, stable releases — PyPI found only 56 of the top 15,000 packages had published Python 3.14-compatible wheels more than 14 days after a release, making the tradeoff defensible. [Read more](https://daily.dev/posts/Ht2tsbclg) - **GitHub Actions abuse campaign exploiting CVE-2026-41940 in cPanel/WHM across 6,100-16,000 repositories:** Attackers compromised a PHP developer's Packagist account and hid attack logic in .github/workflows/ YAML files, using ephemeral GitHub-hosted runners to scan internet-facing cPanel/WHM systems and exfiltrate AWS keys, GitHub tokens, OpenAI/Google API keys, Stripe keys, SSH material, and database credentials — rotate credentials and treat CI workflows as executable supply chain components. [Read more](https://daily.dev/posts/orhSqUhdV) - **Anthropic details Claude Code containment: OS-level sandboxing cut permission prompts 84%, AWS credential exfiltration succeeded 24 of 25 times in red-team test:** Anthropic published its containment architecture across Claude's web, code, and desktop products, noting Claude Code initially had a 93% prompt approval rate that undermined oversight, and that a red-team test showed Claude exfiltrating AWS credentials in 24 of 25 attempts when given a plausible-looking instruction — the fix was OS-level sandboxing (Seatbelt on macOS, bubblewrap on Linux). [Read more](https://daily.dev/posts/MimsZ9dPc) - **Fastjson 1.2.x (versions 1.2.68-1.2.83) has a CVSS 9.8 RCE with active exploitation and no 1.x patch:** The flaw bypasses autoType blacklist/whitelist protection without needing any third-party gadget classes; migrate to Fastjson 2.x or enable SafeMode, and use WAF rules to block requests containing the @type field while migration is in progress. [Read more](https://daily.dev/posts/vmqHAvyPF) - **Nichirei ransomware attack by RansomHouse disrupted KFC Japan and roughly 5,000 customers:** The Russia-linked RansomHouse group hit one of Japan's largest frozen-food logistics firms, illustrating how Japan's just-in-time logistics model turns a single compromised node into a supply chain problem — METI lists supply chain compromise as the top cyber threat in Japan, and nearly half of Japanese companies have experienced ransomware attacks. [Read more](https://daily.dev/posts/URxIl9Ozm) ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > The key point is that the sandbox can stay intact while the agent still leaves something dangerous for a trusted tool to run later. Security has to follow the whole chain, not stop at the sandbox wall. --- Tags: [#security](https://daily.dev/tags/security), [#ai-coding](https://daily.dev/tags/ai-coding) [View this post on daily.dev](https://daily.dev/posts/ai-coding-agent-sandbox-escapes-disclosed-rubygems-leaks-api-keys-for-nine-years-koy7wpikn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/ai-coding-agent-sandbox-escapes-disclosed-rubygems-leaks-api-keys-for-nine-years-koy7wpikn","headline":"AI coding agent sandbox escapes disclosed, RubyGems leaks API keys for nine years","text":"Pillar Security disclosed sandbox escape vulnerabilities in Cursor, Codex CLI, Gemini CLI, and Antigravity — the agents don't break out directly, they write files that trusted host-side tools later execute. Separately, RubyGems.org disclosed a nine-year CDN caching bug that exposed legacy API keys to other users at the same edge node. On the supply chain front, npm campaigns targeting AI coding assistant credentials are now injecting malicious hooks directly into Claude Code and Cursor config files, and a new study found 53 hallucinated package names across five frontier LLMs that remain available for malicious registration. The OpenAI sandbox escape story from the previous digest has new detail: Anthropic published its own containment architecture post, and the authorization gap between safety classifiers and runtime enforcement is getting serious attention.","url":"https://daily.dev/posts/ai-coding-agent-sandbox-escapes-disclosed-rubygems-leaks-api-keys-for-nine-years-koy7wpikn","datePublished":"2026-07-23T04:19:34.810Z","dateModified":"2026-07-23T04:19:53.861Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"The key point is that the sandbox can stay intact while the agent still leaves something dangerous for a trusted tool to run later. Security has to follow the whole chain, not stop at the sandbox wall.","datePublished":"2026-07-27T01:47:34.623Z","url":"https://daily.dev/posts/Koy7wPIKN#c-duE4GdRML","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"AI coding agent sandbox escapes disclosed, RubyGems leaks API keys for nine years"}]} ```