AI coding agents with shell access need sandboxes now
AI coding agents are not smarter autocomplete. They read files, write files, run shell commands, install packages, and push code with the full authority of whoever launched them. Most teams treating them like an IDE extension are operating with a risk surface they have not mapped.
A Harness Is Not a Code Editor
VS Code with an AI assistant is a human tool with AI suggestions. A harness wraps the model in a loop: system prompt, tools, a permission gate, context management, and session memory. The model decides the next action. The harness gives it hands.
The blast radius is not the open file. It is whatever the shell can reach.
The current landscape breaks into three categories. Terminal-native harnesses include Claude Code, Codex CLI, OpenCode, Pi, and Copilot CLI. IDE-shaped ones include Cursor, Antigravity, and Copilot inside VS Code and JetBrains. Cloud variants run on vendor infrastructure and return a pull request.
What the Security Record Shows
Specific vulnerabilities have shown up across major harnesses, all now patched but instructive as a pattern:
- Antigravity: Pillar Security found a parameter in the built-in file-search tool that could run arbitrary binaries, bypassing Secure Mode. Google patched it in February 2026.
- Cursor (CVE-2026-26268, CVSS 8.1): A booby-trapped Git hook in a repository fired the moment the agent ran a Git command. No injection required. Fixed in version 2.5.
- OpenCode (CVE-2026-22812, CVSS 8.8): The tool started an unauthenticated local HTTP server with open CORS, so any website the developer visited could run shell commands on the machine. Fixed in version 1.0.216.
- Cursor MCPoison: An MCP configuration approved once could have its command swapped later with no second prompt.
Beyond these specific CVEs, indirect prompt injection is now a routine finding. Text hidden in code comments, README files, rules files, MCP tool descriptions, or Git hooks gets read as instructions rather than data.
Data exfiltration is a structural risk, not just a theoretical one. Every prompt carries context from source files, configuration, and .env files. Cursor’s privacy mode is off by default on individual plans. Cloud variants move the full repository to vendor infrastructure by design.
The agent also has the shell, which means it has ~/.aws, the kubeconfig, the GitHub token, SSH keys, and a logged-in cloud CLI. It will use them if it decides they help.
️ The Controls That Actually Work
The article lays out a short stack of controls worth pulling from:
- Sandboxes on, not optional. Claude Code uses Seatbelt on macOS and bubblewrap on Linux. Codex enforces OS-level sandboxing with network off by default. GitHub shipped local and ephemeral cloud sandboxes for Copilot in June 2026. Turning a sandbox off should be a logged, privileged action.
- Managed policy pushed from the center. Claude Code’s managed settings file carries deny rules, file-access restrictions, and an MCP allowlist that users cannot override. GitHub’s enterprise managed permissions, generally available since September 2026, let administrators block, require human approval, or allow agent operations at the policy level.
- Short-lived credentials only. Keep long-lived credentials out of shell profiles. Apply deny rules on
.env,~/.ssh, and cloud configuration directories. Scan the agent’s working tree for secrets before commit. - Allowlist MCP servers and pin harness versions. Every fix above only helps on a patched build. Scan rules files, MCP configurations, and Git hooks before the agent touches a fresh clone.
- Log every tool call. Hooks that write every shell command to the SIEM. Retain session transcripts. An interactive session on a laptop running ephemeral agents leaves nothing in the SIEM by default.
- Tier by user type. Professional developers get a local harness under managed policy. Citizen developers (finance analysts, SRE staff, HR ops) get a cloud-sandboxed or browser-hosted variant with guardrails preset and no local shell agent on a corporate laptop.
Does an Enterprise Plan Matter?
Yes, mostly for governance. Single sign-on means no personal account holds company code. SCIM means leavers actually leave. Enterprise terms add no-training and retention commitments, audit logs, spend caps, and MCP allowlists.
Anthropic’s Enterprise plan covers SSO, SCIM, audit logs, and managed policy for Claude Code. The Team plan gets managed settings without the identity controls. OpenAI’s Business and Enterprise tiers do the equivalent for Codex. Cursor and GitHub Copilot have equivalent business tiers. Open-source harnesses have no such plan: the organization builds the controls itself or accepts their absence.
Antigravity is the awkward edge case. Google withdrew the Workspace add-on that carried it in July 2026, pushing much of its use onto personal Google accounts, which the article flags as inappropriate for corporate code.
The Operator Takeaway
Three moves fit inside a quarter, according to the author: name an owner for harness risk; put every agent in a sandbox and make leaving that sandbox a logged event; and give non-developer staff a different, pre-walled box rather than the same local shell agent professional developers use.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
