AI coding agents are breaking out of their sandboxes, researchers warn
AI coding agents are growing fast. Cyberhaven Lab researchers noted in May that adoption jumped 357% between February 2025 and this year, making them the fastest-growing AI tool category. That growth is now attracting serious security scrutiny.
Pillar Security researchers have spent several months auditing the sandboxes of four popular coding agents: Google Gemini CLI, OpenAI Codex, Cursor, and Google Antigravity. Their finding: the flaws they found can be abused without directly targeting the sandboxes themselves.
The Cross-Agent Vulnerability
One vulnerability hit Cursor, Codex, and Gemini CLI at the same time. It allowed agents to launch privileged containers and let a privileged local daemon become a code execution environment outside of the sandbox. In plain terms: the containment boundary stopped being a boundary.
The Cursor CVE
The most specific disclosure is CVE-2026-48124, rated 8.5 (HIGH) on the CVSS scale. The flaw affected Cursor Desktop in versions prior to 3.0.0.
The problem: Cursor could execute workspace-defined Claude hook commands from .claude/settings.local.json without asking the user for approval first. A malicious workspace or an agent-created file could configure hooks that run local commands whenever an agent turn ends.
The consequences the researchers outline are significant:
- Sandbox escape
- Persistence across turns
- Local data access
- Follow-on system compromise
Cursor fixed this in version 3.0.0. If you are running an older version, update now.
️ What This Means for Developers Using These Tools
The pattern Pillar Security describes is worth understanding. These are not attacks that require an adversary to break through the sandbox directly. They exploit the agent’s own permissions and its ability to create or modify files within the workspace. Prompt injection is named as one of the threat vectors in play.
For solo developers and indie teams using Cursor, Codex, or Gemini CLI on real codebases, the practical checklist is short:
- Update Cursor to 3.0.0 or later
- Treat any workspace you did not create yourself as untrusted
- Review what hook commands are configured in
.claude/settings.local.jsonif you use Claude-based workflows - Run agents inside Docker or another container boundary when possible
The full Pillar Security research covers all four agents. The broader takeaway is that sandbox containment for AI coding agents is not a solved problem, and the attack surface grows as these tools take on more autonomous tasks.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
