TLDR Tech / InfoSec
The Week of Sandbox Escapes
Pillar Research identified a common sandbox escape mechanism across several AI agent environments (Cursor, Codex CLI, Gemini CLI, Google Antigravity). The exploit involves the agent writing a file that a trusted, unsandboxed host component later executes, expanding the attack surface beyond the agent's sandbox. This vulnerability stems from four recurring issues: default-allow denylist profiles, executable workspace configurations, inadequate command allowlists, and accessible privileged local daemons. Security recommendations include implementing deny-by-default sandboxing, requiring explicit approval for agent-written host automation, consistent policy application for helper execution, granular command policy modeling, restricting local daemon access, and maintaining file provenance.
Read the full story