Top AI Product

Four of the most-used AI coding agents fell to the same trick, and nobody attacked the sandbox directly.

The agent never breaks the rules

Pillar Security’s team — Eilon Cohen, Dan Lisichkin, Ariel Fogel — published six escapes on July 20, 2026. The method is almost boring: the agent stays inside its sandbox, obeys every restriction, and writes one file. Then a trusted tool outside the box reads that file and runs it. In Cursor, the agent edited a virtualenv interpreter and the unsandboxed Python extension executed it during discovery. Git metadata doesn’t have to live in .git, so an alternate path plus fsmonitor got code running too.

The allowlist problem

Codex CLI trusted git show by name, never modeling what its arguments actually do. A single Docker socket finding hit Codex, Cursor and Gemini CLI at once — a privileged local daemon is an unsandboxed shell if you can reach it. Antigravity had a macOS Seatbelt denylist gap and a .vscode task config that walked past Secure Mode.

Cursor patched in 3.0.0, Codex in 0.95.0. Google downgraded both Antigravity issues as hard to exploit.

You Might Also Like

• Tilde run Hits 162 on Show hn With a git for Agent Runs Sandbox From the Lakefs Team
• Google Gemini Enterprise Gives Every ai Agent a Cryptographic id its Real Fight With Openai and Anthropic
• Google A2ui Agent to User Interface Finally a Standard way for ai Agents to Show you Things
• Gemini Canvas in ai Mode Google Just Turned Search Into a Creative Workspace
• 7 7k Stars and Climbing oh my Codex omx Turns Openais Codex cli Into a Multi Agent Powerhouse