Four major AI coding tools face a sandbox-design warning after BleepingComputer reported that Pillar Security reproduced escape paths in Cursor, OpenAI Codex, Google's Gemini CLI and Google Antigravity without directly attacking the sandbox layer.

The finding turns the security question away from whether an agent remains inside a restricted workspace.

Pillar's research centres on what happens when a trusted tool outside that workspace later reads or runs files that the agent was allowed to create.

Agent Sandboxes Meet Trusted Developer Tools

Enterprise development teams run coding agents inside IDEs, command-line tools and local developer workflows rather than isolated cloud demos.

BleepingComputer identified the affected tools as Cursor, OpenAI Codex, Gemini CLI and Antigravity, while naming Pillar researchers Eilon Cohen, Dan Lisichkin and Ariel Fogel as the team behind the work.

Pillar grouped seven findings into four failure modes: denylist sandboxes that lag operating-system behaviour, workspace configuration files that act as executable code, allowlists that trust a command name more than its arguments, and privileged local daemons that sit outside the sandbox.

The pattern does not require the agent to break its own instructions; the risk appears when the surrounding developer environment treats agent-written files as trusted input.

The affected layer is the surrounding toolchain rather than the model alone.

Extensions, task runners, hooks, Git integrations, interpreters and local services can operate with broader host privileges than the agent workspace.

Cursor, Codex And Gemini Fixes Cover Most Findings

Most of the issues have patches or vendor acknowledgement.

Pillar's material names CVE-2026-48124 for one Cursor finding and records Cursor fixes in version 3.0.0 for more than one issue.

Pillar's disclosure records OpenAI's v0.95.0 Codex CLI patch and a high-severity bounty, with a CVE pending.

A separate Docker socket issue affected Codex, Cursor and Gemini CLI and is now fixed.

The disclosure does not provide customer incident counts or evidence that the findings were exploited in production environments.

The Antigravity handling differs from the rest of the disclosure set.

Google's two findings involved a macOS Seatbelt denylist bypass and a task-configuration bypass of Secure Mode; Pillar's account says Google classified both as valid security vulnerabilities but downgraded severity because exploitation would require social engineering or user trust in a repository carrying indirect prompt injection.

AI Coding Security Extends Beyond The Agent

The same class of problem had already appeared earlier in research from Cymulate, which used the term Configuration-Based Sandbox Escape for a pattern spanning Claude Code, Gemini CLI and Codex CLI.

Pillar's newer work broadens that issue across four tools from three vendors and ties it to everyday developer tooling around repositories and local services.

For security teams, the operating boundary is not only the AI model or the prompt.

Review processes must also cover which local tools can act on files created by agents, which daemons are reachable from development workspaces and whether vendor sandboxes monitor post-write execution by trusted host components.

Pillar's proposed direction is to watch the moment a trusted local tool runs something an agent wrote rather than relying only on lists of banned filenames.

Production exploitation evidence and customer-level mitigation data remain unnamed.