AI Coding Assistants Can Slip Past Their Own Security Cages Without Breaking Them
New research from Pillar Security shows that the sandboxes meant to contain AI coding agents have a fundamental blind spot: the agent never needs to escape if it can simply hand a poisoned file to something that already has permission to run it.
Key points
- Pillar Security disclosed multiple sandbox-escape techniques affecting four AI coding tools: Cursor, Codex CLI, Gemini CLI, and Antigravity.
- In every demonstrated attack, the AI agent stayed inside its sandbox and never triggered a containment alarm.
- The attacks worked by having the agent write files, such as workspace settings or automation scripts, that trusted software outside the sandbox later picked up and ran.
- Docker Desktop's privileged background service, which runs with elevated system permissions, gave sandboxed agents in Cursor, Codex CLI, and Gemini CLI a common escape route.
- Pillar recommends treating any workspace file that can trigger code execution as a sensitive asset requiring human approval before an AI agent can create or change it.
A sandbox, in security terms, is a walled-off area where software runs in isolation so it cannot touch the rest of a computer system. For AI coding assistants, sandboxes are supposed to stop a rogue or manipulated agent from doing damage outside its little corner of the machine.
Pillar Security's new research, first detailed in a post on the company's own site, suggests that wall has a door nobody noticed.
How did the AI agents get out without actually getting out?
They didn't need to. That is the uncomfortable point.
In each attack Pillar demonstrated, the AI agent stayed perfectly inside its sandbox the entire time. It never broke a rule. What it did instead was write a file, a configuration file, a script, a virtual environment folder, the kind of everyday developer file that other trusted programs on the machine are supposed to read and act on.
When that trusted program later picked up the file and ran it, the agent's instructions executed outside the sandbox with the host machine's full permissions. The sandbox never raised an alarm because, technically, nothing escaped it.
Think of it like a prisoner who cannot leave a cell but can slide a note under the door to a guard who then follows the instructions without question.
Pillar found this pattern across several popular AI coding tools. In Antigravity, the researchers abused a macOS security profile called Seabelt, which blocks certain actions by name rather than by what those actions actually do, making it possible to find unlisted routes around it. They also exploited VS Code task configurations, files that tell the code editor to run commands automatically, because those tasks execute on the host machine, outside the sandbox.
Cursor, a widely used AI coding assistant, trusted virtual Python environments and Git hook configurations that an agent created. Both can contain executable code, and both ran with the host machine's privileges when triggered.
A shared weak point across Cursor, Codex CLI, and Gemini CLI was Docker Desktop's background service. Docker is software that packages and runs applications in containers. Its desktop version runs a privileged daemon, meaning a background process with elevated system rights, that sits entirely outside the sandbox. Sandboxed agents could reach it and use it to run commands freely.
For developers and the companies that employ them, the practical advice is straightforward. Treat any file an AI agent creates that could later trigger an action as a sensitive asset. Require a human to approve it before it lands anywhere near automated tools. Make sure helper processes, like Docker's background service, operate under the same tight rules as the agent itself.
If you use any of the affected tools at work, talk to your security team now. The sandbox your organisation relies on may be drawing its boundary in the wrong place.
