Pillar Security reported a set of sandbox-escape and boundary-bypass findings affecting AI coding tools including Cursor, OpenAI Codex CLI, Google’s Gemini CLI and Antigravity. BleepingComputer said most of the issues were patched or acknowledged by vendors.
Pillar Security said its researchers reproduced sandbox escapes and boundary bypasses across several AI coding assistants, including Cursor, OpenAI Codex CLI, Google’s Gemini CLI and Antigravity.
In a post titled “The Week of Sandbox Escapes”, Pillar Security said the findings fell into repeatable failure modes rather than isolated implementation mistakes. The company described issues involving writable project files, unsafe command allowlists and host-side trusted components that could be reached from inside an assistant’s restricted environment.
BleepingComputer reported that Pillar disclosed sandbox-escape research affecting Cursor, OpenAI Codex, Google’s Gemini CLI and Antigravity, and said most of the issues were either patched or acknowledged by vendors.
The research focuses on a key security problem for AI coding assistants: these tools often need broad access to local projects, developer tools and build systems, while also trying to limit what model-driven or tool-driven actions can do on the host machine. Pillar’s posts argue that those boundaries can fail when trusted local services, permissive allowlists or writable files become part of an escape path.
In a separate write-up, “One Docker socket to rule them all”, Pillar Security described a Docker Desktop-based escape path that it said affected Codex CLI, Cursor and Gemini CLI. According to the post, a sandboxed coding assistant could reach a privileged local daemon outside the intended sandbox boundary.
The issue described by Pillar is not merely that Docker is installed on a developer machine. The company’s claim is that access from a restricted assistant environment to a more privileged host-side component can undermine the sandbox’s isolation guarantees. In that scenario, the assistant’s execution environment may appear constrained, while the reachable daemon can perform operations with broader authority on the host.
Pillar also detailed a Codex CLI issue in “GitPwned: Allowlist to RCE”. The company said the flaw involved a safe-command allowlist that trusted git show by name. Pillar reported that the behavior could be abused to write attacker-controlled data to Git configuration and later achieve host-level code execution.
Pillar said OpenAI patched that Codex CLI issue in version 0.95.0. The post presents the case as an example of why command allowlists need to account for how permitted commands can be shaped by attacker-controlled repository content, configuration files or command arguments.
The disclosures underline a practical challenge for vendors building coding assistants: the tools are most useful when they can inspect files, run commands and interact with local development infrastructure, but those same capabilities increase the consequences of weak isolation.
Based on Pillar Security’s reporting, the common thread is that a sandbox boundary is only as strong as the components it trusts. Writable project files, local daemons and broad command permissions can all become part of an unintended path from a restricted coding workspace to the developer’s host environment.
BleepingComputer’s report that most of the issues were patched or acknowledged suggests vendors are responding, but the research also indicates that sandboxing AI coding assistants will require continued attention to local integrations, default permissions and the assumptions behind trusted command lists.
Pillar Security said its researchers reproduced sandbox escapes and boundary bypasses across several AI coding assistants, including Cursor, OpenAI Codex CLI, Google’s Gemini CLI and Antigravity.
Researchers point to recurring sandbox weaknesses In a post titled “The Week of Sandbox Escapes”, Pillar Security said the findings fell into repeatable failure modes rather than isolated implementation mistakes.
The company described issues involving writable project files, unsafe command allowlists and host side trusted components that could be reached from inside an assistant’s restricted environment.
Continue reading
