AI coding agents bypass sandboxes by feeding trusted host tools malicious files
Pillar Security uncovered repeatable sandbox‑escape techniques in Cursor, OpenAI Codex, Google Gemini CLI and Antigravity. The agents stay inside their workspaces but write files that downstream host utilities automatically run, scan, or load, effectively crossing the security boundary. Vendors have patched several CVEs; Google downgraded two findings.